CVE-2026-45406 Details

A critical vulnerability allowing remote code execution has been identified in Dokku versions prior to 0.38.2. The issue arises in the openresty-vhosts plugin, which improperly handles filenames from an application's openresty/http-includes/ git repository directory. The plugin copies these files to the host and interpolates their names, unescaped, into a single-quoted shell string that is later executed using eval. Filenames containing a single quote can break the string's quoting, enabling command substitution to execute arbitrary commands on the host as the dokku user during the application's next deployment. This vulnerability affects installations using the openresty proxy plugin and can be exploited by any Dokku user with push access to the affected application.

Users can upgrade to Dokku version 0.38.2 or later to address this vulnerability.