CVE-2026-86002

Summary

Dokku allows users with app-level access and SSH privileges to store arbitrary strings through the docker-options plugin that get processed by Bash eval during build/deploy/run operations, enabling remote code execution as the dokku user. This is a critical privilege escalation vulnerability.

Exploitability

Moderately difficult to exploit requiring both app-level access and SSH access to execute docker-options commands, with the attacker needing to craft shell command substitutions that will be evaluated by Bash during container operations.

Blast radius

High impact across all applications deployed on the Dokku instance, as any exploited application could allow attackers to execute arbitrary commands with the dokku user privileges, potentially leading to full system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Dokku version 0.38.25 or later to fix the shell injection vulnerability in the docker-options plugin.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.