Executive brief
Dokku is an open-source platform used to deploy and manage applications in Docker containers. A security flaw in its cron scheduling plugin allows users with application deployment access to escape their isolated container. By including special characters in a configuration file, an attacker can execute unauthorized commands directly on the host server, potentially leading to a full system takeover or data theft.
Technical details
An OS command injection vulnerability exists in Dokku's cron plugin prior to version 0.38.7. The docker-local scheduler incorrectly writes cron commands from the app.json file directly into the host's crontab for the 'dokku' user. Because these commands are interpreted by the host's shell (bash -c) rather than being executed strictly within the container, an attacker can use shell metacharacters (e.g., ';', '>', '|') to break out of the containerized environment. Exploitation requires the attacker to have push access to an application. The vulnerability is resolved in version 0.38.7 by changing the crontab entry to use a wrapper command that resolves and executes the cron task inside the container at runtime.
Affected products
- Dokku Dokku < 0.38.7
Timeline
- 2026-05-25: patched: Fix merged into master branch
- 2026-05-27: other: Release 0.38.7 published
- 2026-06-16: advisory: GitHub Security Advisory published
- 2026-06-26: disclosed: CVE published to NVD