CVE-2026-54636 is a critical flaw (CVSS 9.0) in Dokku before 0.38.7. Shell characters in an app.json cron command are interpreted on the host as the Dokku user instead of inside the container. Anyone with push access to an affected app can trigger it. Upgrade to Dokku 0.38.7.
What's affected
- Dokku before 0.38.7, per the record.
- Fixed in 0.38.7.
- The advisory says it applies to installations using the app.json cron integration, exploitable by a Dokku user with push access to an app where openresty is the configured proxy.
How to check if you're exposed
Check the version on the host.
dokku version
Then check whether you use cron in app.json and which proxy each app uses. Review the crontab of the dokku user for lines that contain long or unusual commands, and list who holds push access to your apps through their SSH keys.
What to do now
- Upgrade Dokku to 0.38.7 or later.
- Review the dokku user crontab and each app.json cron entry for commands you do not recognize.
- Audit SSH keys with push access and remove those you no longer need.
- Run untrusted or customer supplied apps on a separate host.
Why it matters
The class is CWE-78, OS command injection. The pull request notes that the scheduler wrote each cron command into the crontab of the dokku user, where the shell interpreted its metacharacters on the host. The fix writes a short line that calls dokku cron:run and resolves the command from app.json at run time, inside the container. Deploy time validation also rejects commands with shell operators.
The lesson is where a command is parsed. The author expected container scope, but a host shell read the text first. The record does not mark the CVE as exploited in the wild.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Quick check
Does this need a Dokku admin account?
The advisory says any Dokku user with push access to an app in the affected setup can exploit it.
Sources
- https://github.com/dokku/dokku/security/advisories/GHSA-72vm-7pc2-x95w
- https://github.com/dokku/dokku/pull/8672
Last reviewed: 19 October 2026.
