CVE-2026-86002

Name of the Vulnerable Software and Affected Versions Dokku versions prior to 0.38.25

Description A user with app-level access and remote SSH access to execute docker-options commands can store arbitrary strings via the docker-options plugin. These strings are concatenated into the DOCKER ARGS variable and processed by Bash eval during build, deploy, or run operations. Because shell command substitutions in these stored values are interpreted on the host, an attacker can execute arbitrary commands with the privileges of the dokku operating-system user.

Recommendations Update to version 0.38.25.