VulnerabilityAnalyzed
CVE-2026-45407
This vulnerability is fixed in 0.38.2.
MEDIUM 5.5EPSS 0.13%
Does this matter?
Lower severity and a low EPSS score (0.13%). Track it; it rarely justifies an emergency change on its own.
Description
Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:auth command creates $DOKKU_ROOT/.netrc using bash's touch command, which applies the default umask of 0644. This pre-creation defeats the netrc binary's built-in 0600 permission setting, leaving git credentials readable by any local user who can traverse the dokku home directory. This vulnerability is fixed in 0.38.2.
- CVSS 3.1
- 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.13% probability · 2th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-522
- Affected
- dokku/dokku
- Source
- security-advisories@github.com
References
- https://github.com/dokku/dokku/pull/8589Issue Tracking, Patch
- https://github.com/dokku/dokku/security/advisories/GHSA-xh7p-9crg-pchrVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.