CVE-2026-54636

critical · 9

Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku user. An app.json cron command utilizing special shell characters - including, but not limited to, > or ; - can break out of the Docker container and execute commands on the host as the Dokku user. This vulnerability is fixed in 0.38.7.

CVSS

0.5%

EPSS (exploit prob.)

44th

EPSS percentile

2026-06-26

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
dokku	dokku	< 0.38.7

Check a specific version with /api/v1/cve/match.

References

https://github.com/dokku/dokku/pull/8672
https://github.com/dokku/dokku/security/advisories/GHSA-72vm-7pc2-x95w

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-54636