Quick answers
- Is CVE-2026-45406 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-45406 being exploited in the wild.
- How severe is CVE-2026-45406?
- Critical severity, with a CVSS score of 9, published 26 June 2026.
- Which products and versions are affected?
- Dokku < 0.38.2.
- Is there a fix for CVE-2026-45406?
- A patch was published on 2026-05-09: Fix merged in pull request #8588 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-45406 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-45406?
- Check whether you run Dokku at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An eval injection vulnerability exists in the Dokku openresty-vhosts plugin prior to version 0.38.2. The plugin copies files from an application's 'openresty/http-includes/' directory and interpolates the filenames into a single-quoted shell string without proper escaping. An attacker with push access can craft a filename containing a single quote and command substitution syntax (e.g., `poc'$(cmd)'x.conf`) to break out of the shell quoting. When the application is next deployed, the malicious filename is processed by 'eval', leading to arbitrary command execution on the host as the 'dokku' user. The fix introduces filename validation using a strict regex and skips non-regular files during extraction.
Affected products
- Dokku Dokku < 0.38.2
Timeline
- 2026-05-09: patched: Fix merged in pull request #8588
- 2026-05-10: other: Release 0.38.2 published
- 2026-05-13: advisory: GitHub Security Advisory published
- 2026-06-26: disclosed: CVE published to NVD