VYPR
← All advisories
Medium severity5.0OSV Advisory· Published Jun 26, 2026· Updated Jun 26, 2026

CVE-2026-45407

CVE-2026-45407

Description

Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:auth command creates $DOKKU_ROOT/.netrc using bash's touch command, which applies the default umask of 0644. This pre-creation defeats the netrc binary's built-in 0600 permission setting, leaving git credentials readable by any local user who can traverse the dokku home directory. This vulnerability is fixed in 0.38.2.

Affected products

3
  • Dokku/Dokku3 versions
    cpe:2.3:a:dokku:dokku:*:*:*:*:-:*:*:*+ 2 more
    • cpe:2.3:a:dokku:dokku:*:*:*:*:-:*:*:*range: <0.38.2
    • (no CPE)range: <0.38.2
    • (no CPE)range: v0.38.1, v0.38.0, v0.37.10, …

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.