---
id: CVE-2026-54636
title: Dokku is a docker-powered PaaS
summary: >-
  Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes
  commands in the app.json file to manage system cron running as the Dokku user.
  An app.json cron command utilizing special shell characters - including, but
  not lim…
severity: critical
cvss: 9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H'
cwe:
  - CWE-78
published: '2026-06-26'
updated: '2026-06-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54636'
references:
  - url: 'https://github.com/dokku/dokku/pull/8672'
    label: security-advisories@github.com
  - url: 'https://github.com/dokku/dokku/security/advisories/GHSA-72vm-7pc2-x95w'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00529
epssPercentile: 0.42343
ingestedAt: '2026-06-29T14:29:18.119Z'
---

## Overview

Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku user. An app.json cron command utilizing special shell characters - including, but not limited to, > or ; - can break out of the Docker container and execute commands on the host as the Dokku user. This vulnerability is fixed in 0.38.7.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.