PT-2026-52852 · Dokku · Dokku

Publicado 2026-06-26 · Atualizado 2026-06-26 · CVE-2026-45407

Mitre

CVSS v3.1

5.0

Média

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:auth command creates $DOKKU ROOT/.netrc using bash's touch command, which applies the default umask of 0644. This pre-creation defeats the netrc binary's built-in 0600 permission setting, leaving git credentials readable by any local user who can traverse the dokku home directory. This vulnerability is fixed in 0.38.2.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2026-45407

Produtos afetados

Dokku

Referências · 3

• https://github.com/dokku/dokku/security/advisories/GHSA-xh7p-9crg-pchr · Aviso do Fabricante
• https://github.com/dokku/dokku/pull/8589 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-45407 · Nota de Segurança