Key points
- The vulnerability affects Dokku versions prior to 0.38.25 and is rated critical by the NVD.
- Attackers with app-level access can inject arbitrary commands through docker-options settings.
- Version 0.38.25 resolves the issue by preventing unsafe bash evaluation of stored strings.
Dokku versions before 0.38.25 contain a critical security flaw that allows remote code execution on the host system. The National Vulnerability Database assigns this issue CVE-2026-86002 with a CVSS score of 9. The vendor has released version 0.38.25, which includes a fix for this vulnerability. Security teams should verify their current version immediately to determine if they are exposed.
In plain English
The problem occurs when users with app-level access modify docker-options settings. These settings are stored as text strings and later used during build, deploy, or run operations. The system combines these strings into a variable called DOCKER_ARGS. Bash then evaluates this variable using the eval command. If an attacker inserts shell command substitutions into the stored values, the host interprets them as real commands. This allows the attacker to run arbitrary code with the privileges of the dokku user.
The background
Dokku is a platform as a service powered by Docker. It allows developers to deploy applications using Git. The docker-options plugin lets users customize container settings. In affected versions, the plugin does not sanitize inputs before passing them to Bash. This lack of validation turns configuration fields into command injection vectors. As Vuln Post reported on 2026-10-13, similar command injection flaws have appeared in other platforms like Adobe Experience Manager.
What changes now
Version 0.38.25 fixes the unsafe handling of docker-options inputs. The update ensures that stored strings are not processed by Bash eval in a way that executes arbitrary commands. Users running versions older than 0.38.25 remain vulnerable to remote code execution. There is no confirmed patch for any version below 0.38.25. Upgrading to 0.38.25 is the only way to eliminate this specific risk.
Who needs to act first
Teams should prioritize systems that expose SSH access to external users or untrusted developers. Check whether any applications allow low-privileged users to modify docker-options. If so, update those instances before internal-only systems. Roll out the fix in a staging environment first to ensure compatibility with existing deployments. Back up current configurations before upgrading. Monitor logs for signs of unauthorized command execution during the transition period.
What to do and how to stay safe: Dokku
- Check your Dokku version and compare it against 0.38.25 to see if you are affected.
- Restrict SSH access to only trusted administrators until the update is applied.
- Audit docker-options configurations for any suspicious or unexpected command substitutions.
- Plan a maintenance window to upgrade to version 0.38.25 and verify the fix works.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Dokku are affected by CVE-2026-86002?
All Dokku versions before 0.38.25 are affected by this critical command injection flaw.
Is there a patch available for this vulnerability?
Yes, version 0.38.25 fixes the issue by preventing unsafe bash evaluation of docker-options.
What privileges does an attacker gain from exploiting this flaw?
An attacker can execute arbitrary commands with the privileges of the dokku operating-system user.
