What is CVE-2026-86002?

CVE-2026-86002 is a critical-severity vulnerability in Dokku, classified under Eval Injection. CVSS score: 9.0/10. Published 2026-10-14.

How severe is CVE-2026-86002?

Critical severity. CVSS v3 base score is 9.0 out of 10.

RCE in Dokku

CVE-2026-86002

Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKER_ARGS and processed by Bash eval during build, deploy, or run operations. Shell command substitutions in the stored values are interpreted on the host, allowing arbitrary command execution with the privileges of the dokku operating-system user. This issue is fixed in version 0.38.25.

Published 2026-10-14 · last modified 2026-10-14.

CVSS v3 metric

CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Dokku — versions < 0.38.25

Weakness classification (CWE)

CWE-95 — Eval Injection

References

Frequently asked questions

What is CVE-2026-86002?: CVE-2026-86002 is a critical-severity vulnerability in Dokku, classified under Eval Injection. CVSS score: 9.0/10. Published 2026-10-14.
How severe is CVE-2026-86002?: Critical severity. CVSS v3 base score is 9.0 out of 10.