Dokku: Command injection via docker-options eval in DOCKER_ARGS
Summary
Dokku, a Docker-based platform as a service, contains a command injection flaw in the docker-options handling. A user with app-level Dokku access and SSH access who can run docker-options commands can store arbitrary strings that are later evaluated by Bash during build, deploy or run operations. Shell command substitutions in these stored values are executed on the host with the privileges of the dokku operating-system user.
Affected
- Dokku versions before 0.38.25
- Versions earlier than 0.38.25 are treated as affected. Whether releases before 0.38 are affected is unknown.
Fixed in
- Dokku 0.38.25 (fix commit 1a376c3, pull request #8848)
- The newest 0.38.x release is recommended.
Workaround
Unknown. No vendor workaround is documented.
- Interim measures until the patch is applied (own assessment): restrict Dokku and SSH access to trusted accounts, review app-level access, and audit stored docker-options values for shell syntax such as $(...) or backticks.
Exploitation
- No public exploit or in-the-wild exploitation is known at the time of writing.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
Our recommendation
- Update Dokku to version 0.38.25 or later on all affected hosts.
- Review which users hold app-level Dokku and SSH access and remove accounts that are no longer needed.
- Audit existing docker-options values for shell syntax and check the dokku user for unexpected activity.
- Prioritize hosts shared with multiple developers, customers or contractors.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 1a376c3 (GitHub) github.com
- Pull request #8848 (GitHub) github.com
- Dokku release v0.38.25 (GitHub) github.com
- Security advisory GHSA-fccf-j7qf-2xp9 (GitHub) github.com
- OSV entry CVE-2026-86002 osv.dev
- VulDB entry 420089 vuldb.com
- Vulners MEND entry CVE-2026-86002 vulners.com
- Release notes v0.38.25 (newreleases.io) newreleases.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:10.
Original description (NVD)
Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKER_ARGS and processed by Bash eval during build, deploy, or run operations. Shell command substitutions in the stored values are interpreted on the host, allowing arbitrary command execution with the privileges of the dokku operating-system user. This issue is fixed in version 0.38.25.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.