CVE-2026-54636: Dokku: OS Command Injection via app.json managed Cron

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-26 · updated 2026-06-29
Weakness: CWE-78

Description

Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku user. An app.json cron command utilizing special shell characters - including, but not limited to, > or ; - can break out of the Docker container and execute commands on the host as the Dokku user. This vulnerability is fixed in 0.38.7.

Affected products

dokku: before 0.38.7 — fixed in 0.38.7

How to fix

Upgrade to a fixed version: dokku 0.38.7. Check the vendor advisory for mitigations.

References

https://github.com/dokku/dokku/pull/8672
https://github.com/dokku/dokku/security/advisories/GHSA-72vm-7pc2-x95w

Get alerted when CVE-2026-54636 or the next vulnerability affects your stack