# CVE-2026-45407: Dokku insecure file permissions in git:auth credentials file

Source: https://junglewise.ai/threats/cve-2026-45407-dokku-insecure-file-permissions-in-git-auth-credentials-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-45407 · Severity: medium · CVSS 5 · Published 2026-06-26

Dokku, a platform for deploying and managing applications, contains a flaw that leaves sensitive login credentials exposed on the server. Because of a configuration error when creating the authentication file, these credentials are saved with overly broad permissions. This allows any user with local access to the server to read the credentials, potentially leading to the theft of Git account access and unauthorized access to source code.

Technologies: [Dokku](https://junglewise.ai/threats/technologies/dokku). Vendors: [Dokku](https://junglewise.ai/threats/vendors/dokku).

## Quick answers

**Is CVE-2026-45407 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45407 being exploited in the wild.

**How severe is CVE-2026-45407?** Medium severity, with a CVSS score of 5, published 26 June 2026.

**Which products and versions are affected?** Dokku < 0.38.2.

**Is there a fix for CVE-2026-45407?** A patch was published on 2026-05-09: Pull request #8589 merged to enforce permissions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45407 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-45407?** Check whether you run Dokku at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in Dokku's git:auth command stems from the use of the bash 'touch' command to initialize the $DOKKU_ROOT/.netrc file before the netrc binary can set its own restrictive permissions. Because 'touch' respects the system's default umask (typically 0644), the file is created with world-readable permissions, bypassing the netrc binary's intended 0600 (owner-only) setting. A local attacker with shell access to the Dokku host can read this file to obtain plaintext Git credentials. The issue is resolved in version 0.38.2, which explicitly enforces 0600 permissions and repairs existing installations.

## Affected products

- Dokku Dokku < 0.38.2

## Timeline

- 2026-05-09: patched: Pull request #8589 merged to enforce permissions.
- 2026-05-10: advisory: Release 0.38.2 published.
- 2026-06-26: disclosed: CVE-2026-45407 published.

## References

- [https://github.com/dokku/dokku/pull/8589](https://github.com/dokku/dokku/pull/8589)
- [https://github.com/dokku/dokku/security/advisories/GHSA-xh7p-9crg-pchr](https://github.com/dokku/dokku/security/advisories/GHSA-xh7p-9crg-pchr)

## Related threats

- [Dokku command injection via docker-options eval](https://junglewise.ai/threats/cve-2026-86002-dokku-is-a-docker-powered-platform-as-a-service-in-dokku-versions)
- [Dokku command injection and container escape in cron plugin](https://junglewise.ai/threats/cve-2026-54636-dokku-command-injection-and-container-escape-in-cron-plugin)
- [Dokku OS command injection via app name in git pre-receive hook](https://junglewise.ai/threats/cve-2026-45408-dokku-os-command-injection-via-app-name-in-git-pre-receive-hook)
- [Dokku openresty-vhosts eval injection in filenames](https://junglewise.ai/threats/cve-2026-45406-dokku-openresty-vhosts-eval-injection-in-filenames)
- [Dokku arbitrary file write via symlink traversal in archive extraction](https://junglewise.ai/threats/cve-2026-45405-dokku-arbitrary-file-write-via-symlink-traversal-in-archive)