CVE-2026-45407 Details
Description
Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:auth command creates $DOKKU_ROOT/.netrc using bash's touch command, which applies the default umask of 0644. This pre-creation defeats the netrc binary's built-in 0600 permission setting, leaving git credentials readable by any local user who can traverse the dokku home directory. This vulnerability is fixed in 0.38.2.
A vulnerability in Dokku versions prior to 0.38.2 allows Git credentials to be stored with insecure permissions. The issue arises because the 'git:auth' command creates the '$DOKKU_ROOT/.netrc' file using the 'touch' command, which applies a default permission of 0644. This pre-creation process overrides the 'netrc' binary's default permission of 0600, leaving Git credentials readable by any local user who can access the Dokku home directory. The vulnerability can be exploited by local users on the Dokku host.
Users can manually change the permissions of the '.netrc' file to '0600' after using the 'git:auth' command. Dokku users should also consider updating to version 0.38.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dokku/dokku/pull/8589 | [email protected] | Issue TrackingPatch |
| https://github.com/dokku/dokku/security/advisories/GHSA-xh7p-9crg-pchr | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dokku dokku | < 0.38.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | New CVE Received | [email protected] |