Dokku, a docker‑powered PaaS, creates a $DOKKU_ROOT/.netrc file when the git:auth command is run. Prior to version 0.38.2, the applies the system umask of 0644. This step prevents .netrc's built‑in 0600 permission setting from being applied, allowing the file to be world‑readable. The credentials stored within are git authentication tokens, so any local user who can traverse the Dokku home directory can read them, potentially compromising remote git repositories. This weakness is identified as CWE‑522, exposing sensitive personal data to unauthorized users.

The affected product is Dokku, specifically versions earlier than 0.38.2. Any instance running these versions is vulnerable if the git:auth command is exercised and the Dokku home directory is not properly protected.

The CVSS score of 5 indicates moderate overall risk. The EPSS score is not available, so the likelihood of exploitation is uncertain but the vulnerability does not require network access and can be exploited by any local user who can access the Dokku deployment. The vulnerability is not listed in the CISA KEV catalog. Attackers would need local file system access to the Dokku root, then can read the .netrc file to obtain git credentials. The flaw is straightforward to exploit once the environment grants such access, and the consequences are credential compromise.