CVE-2026-45407: Dokku Git Credentials Exposed via Insecure .netrc Permissions

Technical summary

In Dokku versions prior to 0.38.2, the git:auth command uses bash's touch utility to pre-create the $DOKKU_ROOT/.netrc file before populating it with credentials. The touch command respects the system umask (typically 0644), which results in world-readable file permissions. Although the netrc binary is designed to enforce 0600 permissions (readable only by the owner), the pre-creation bypasses this protection mechanism. The resulting .netrc file remains readable by any local user able to traverse the dokku home directory, enabling credential disclosure. The fix ensures proper permissions are applied during file creation, preventing the umask bypass.

Business impact

Organizations deploying Dokku in multi-tenant or shared-host environments face credential exposure risk. Local users or compromised application containers can read plaintext git credentials, potentially enabling unauthorized code repository access, supply chain compromise, and lateral movement within development infrastructure. The impact is confined to local threat actors but is severe when Dokku runs on shared systems or in containerized environments with weak isolation boundaries.

Affected systems

Dokku versions prior to 0.38.2 are affected. The vulnerability applies specifically to deployments using the git:auth command to configure authentication. Systems where multiple local users share access to the Dokku home directory are at highest risk. Users running version 0.38.2 or later are not affected.

Exploitability

Exploitation requires local system access and the ability to navigate to the $DOKKU_ROOT directory. Once accessible, an attacker can read the unencrypted .netrc file and extract git credentials in plaintext. No special privileges, tools, or user interaction beyond file system traversal are required. The CVSS vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) reflects that exploitation is low-complexity, requires low privilege, and carries high confidentiality impact with no integrity or availability compromise. The UI:R flag indicates some user interaction may factor into the scenario model.

Remediation

Upgrade to Dokku version 0.38.2 or later. The patch corrects the file creation process to ensure .netrc is created with 0600 permissions, preventing the umask bypass. Organizations unable to upgrade immediately should restrict local user access to the Dokku home directory via file system permissions or directory structure isolation. Credential rotation after patching is prudent given the exposure window.

Patch guidance

Apply the upgrade to Dokku 0.38.2 or any subsequent version. Verify the patch by confirming that newly created .netrc files have 0600 permissions (readable and writable only by the dokku user). Test the git:auth command in a non-production environment to ensure credentials are properly stored and git operations remain functional. Restart or redeploy affected applications after patching.

Detection guidance

Audit existing .netrc files in $DOKKU_ROOT to identify any with permissions greater than 0600 using 'ls -la' or 'stat' commands. Log git:auth command executions and monitor for any instances of file permission changes on .netrc. For forensic analysis, check access logs for unauthorized reads of the Dokku home directory by unprivileged users. Implement file integrity monitoring to detect unauthorized modifications to credential files.

Why prioritize this

This vulnerability merits prompt remediation in any multi-user or shared-host Dokku deployment. Although the CVSS score is moderate (5.0 MEDIUM), the local access requirement does not diminish the severity of exposing plaintext git credentials, which are high-value attack targets. Organizations should prioritize based on deployment model: shared-host or multi-tenant Dokku instances should receive urgent attention, while single-tenant or isolated deployments are lower-risk but still warrant timely patching.

Risk score, explained

The CVSS 3.1 score of 5.0 MEDIUM reflects a local attack vector (AV:L), low attack complexity (AC:L), and requirement for low privilege (PR:L). The high confidentiality impact (C:H) from credential exposure is offset by the local-only scope and lack of integrity or availability impact. The score does not capture the full context of supply chain risk or lateral movement potential from stolen git credentials; organizations should consider business context when evaluating priority.

Frequently asked questions