PT-2026-52852 · Dokku · Dokku

Published 2026-06-26 · Updated 2026-06-26 · CVE-2026-45407

Mitre

CVSS v3.1

5.0

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:auth command creates $DOKKU ROOT/.netrc using bash's touch command, which applies the default umask of 0644. This pre-creation defeats the netrc binary's built-in 0600 permission setting, leaving git credentials readable by any local user who can traverse the dokku home directory. This vulnerability is fixed in 0.38.2.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2026-45407

Affected Products

Dokku

References · 3

• https://github.com/dokku/dokku/security/advisories/GHSA-xh7p-9crg-pchr · Vendor Advisory
• https://github.com/dokku/dokku/pull/8589 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-45407 · Security Note