CVE-2026-45407

MEDIUM

Dokku: Git Credentials in .netrc Stored World-Readable Due to Premature touch

Title source: cna
STIX 2.1

Description

Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:auth command creates $DOKKU_ROOT/.netrc using bash's touch command, which applies the default umask of 0644. This pre-creation defeats the netrc binary's built-in 0600 permission setting, leaving git credentials readable by any local user who can traverse the dokku home directory. This vulnerability is fixed in 0.38.2.

References (2)

Core 2
Core References
X_Refsource_Misc x_refsource_misc
https://github.com/dokku/dokku/pull/8589

Scores

CVSS v3 5.0
EPSS 0.0009
EPSS Percentile 0.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-522
Status published
Products (1)
dokku/dokku < 0.38.2 (2 CPE variants)
Published Jun 26, 2026
Tracked Since Jun 26, 2026