Dokku Command Injection via Docker Options Plugin in Pre-0.38.25 Builds

A command injection vulnerability in the open-source platform-as-a-service software Dokku enables attackers to run arbitrary commands on the host system. The issue, tracked as CVE-2026-86002, affects installations that have not been updated to version 0.38.25. According to the National Vulnerability Database, the flaw allows a user with app-level access and remote SSH capabilities to manipulate the docker-options plugin. This manipulation leads to the execution of shell command substitutions with the privileges of the dokku operating-system user.

Root cause

The underlying weakness is classified as CWE-95, or Improper Neutralization of Directives in Dynamically Evaluated Code. In Dokku versions before 0.38.25, the docker-options plugin permits users to store arbitrary strings. These strings are subsequently concatenated into a variable named DOCKER_ARGS. During standard operations such as building, deploying, or running applications, the system processes this variable using Bash eval. Because the stored values are not sanitized, any shell command substitutions embedded within them are interpreted by the host shell, leading to unintended command execution.

Attack path

An attacker must first possess app-level access to a Dokku instance and have remote SSH access to execute docker-options commands. Once access is established, the attacker stores malicious strings through the docker-options plugin. These strings contain shell syntax designed to be executed later. When the application undergoes a build, deploy, or run operation, the system invokes Bash eval on the DOCKER_ARGS variable. The shell then interprets the injected command substitutions, allowing the attacker to execute arbitrary commands on the host machine with the privileges of the dokku user.

Affected versions

• Dokku versions prior to 0.38.25 are vulnerable to this command injection flaw.
• The issue is resolved in Dokku version 0.38.25.
• Any installation running a version lower than 0.38.25 is considered affected by CVE-2026-86002.

Mitigation

• Upgrade the Dokku installation to version 0.38.25 or later to apply the vendor-provided fix.
• Restrict SSH access to the docker-options command to prevent unauthorized users from injecting malicious strings.
• Audit existing applications for any suspicious entries in their docker-options configurations that may have been used for exploitation.
• Monitor system logs for unexpected command executions originating from the dokku user account during build or deploy phases.

Signals worth monitoring

Teams usually look for anomalous process creation events originating from the dokku user account, especially during application build or deployment windows. Security operations centers should check whether bash processes are spawning unexpected child processes that do not match standard container runtime behavior. Analysts often review SSH session logs for unusual docker-options command invocations that deviate from normal configuration patterns. Containment typically involves isolating the affected application container and disabling SSH access for the specific user account until the root cause is identified and remediated.

Background: Command injection

Command injection occurs when an application passes untrusted input directly to a system shell. This allows attackers to execute arbitrary commands on the server. You prevent it by avoiding shell execution entirely or by strictly validating and escaping all user-supplied input before processing.

Read the full guide: Command Injection: How It Works and How to Stop It

What to do and how to stay safe: Dokku

• Verify the current version of your Dokku installation and compare it against the list of affected releases.
• Review SSH access controls to ensure only authorized personnel can execute docker-options commands on your servers.
• Inspect application configuration files for any unexpected shell syntax or command substitutions within docker-options settings.
• Once the vendor provides an update, apply the patch to version 0.38.25 or newer to close the vulnerability.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity rating for CVE-2026-86002?

The National Vulnerability Database rates the severity as Critical with a CVSS score of 9.

Which versions of Dokku are affected by this vulnerability?

All Dokku versions prior to 0.38.25 are affected by this command injection flaw.

Is there a fix available for this issue?

Yes, the issue is fixed in Dokku version 0.38.25.