CVE-2026-129433
Deferred Deferred - Pending Action

OS Command Injection in Dokploy Before 0.31.1

Publication date: 2026-11-14

Last updated on: 2026-11-14

Assigner: VulnCheck

Description
Dokploy before 0.31.1 contains an OS command injection vulnerability in getComposeContainerCommand() that allows authenticated organization members to execute shell commands via the serviceName parameter. Attackers can store serviceName values with shell metacharacters through backup.create or backup.update tRPC procedures, executing commands as root when scheduled backups run and taking over the host via the mounted Docker socket.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-14
Last Modified
2026-11-14
Generated
2026-11-15
AI Q&A
2026-11-14
EPSS Evaluated
N/A
NVD
CVE-2026-129433
EUVD
EUVD-2026-125911

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dokploy dokploy to 0.31.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-129433 is an OS command injection flaw in Dokploy versions before 0.31.1. It occurs in the backup creation and update functions where the serviceName parameter is directly used in shell commands without sanitization. Attackers with member-level access can inject malicious commands via shell metacharacters in serviceName, which execute as root when scheduled backups run. This leads to full host takeover due to Dokploy's mounted Docker socket.

Detection Guidance

Check Dokploy versions prior to 0.31.1 using 'dokploy version' or inspect the Docker container tag. Review backup logs for unusual commands or outputs in serviceName fields. Monitor network traffic for unexpected outbound connections from Dokploy.

Impact Analysis

An attacker with member access can execute arbitrary root commands on the host system. This includes stealing sensitive data like environment variables, deployment keys, and database credentials managed by Dokploy. The default backup schedule (every minute) allows rapid exploitation. Full system compromise is possible due to the Docker socket mount.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized root access enabling data exfiltration of sensitive personal or health information. Full host compromise risks breaches of confidentiality and integrity requirements. Organizations using affected versions must patch immediately to maintain compliance.

Mitigation Strategies

Upgrade Dokploy to version 0.31.1 or later immediately. If upgrading is not possible, restrict member access to backup functions and disable scheduled backups temporarily. Review and sanitize all backup configurations for malicious serviceName values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-129433. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...