CVE-2026-24839

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2026-01-28

Last updated on: 2026-02-04

Assigner: GitHub, Inc.

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, the Dokploy web interface is vulnerable to Clickjacking attacks due to missing frame-busting headers. This allows attackers to embed Dokploy pages in malicious iframes and trick authenticated users into performing unintended actions. Version 0.26.6 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-28

Last Modified

2026-02-04

Generated

2026-07-06

AI Q&A

2026-01-29

EPSS Evaluated

2026-07-05

NVD

CVE-2026-24839

EUVD

EUVD-2026-4903

Affected Vendors & Products

Vendor	Product	Version / Range
dokploy	dokploy	to 0.26.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1021	The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.

Attack-Flow Graph

Executive Summary

This vulnerability in Dokploy versions prior to 0.26.6 is a Clickjacking issue caused by missing frame-busting headers in the web interface. This allows attackers to embed Dokploy pages within malicious iframes and trick authenticated users into performing unintended actions.

Impact Analysis

The vulnerability can lead to attackers tricking authenticated users into executing unintended actions on Dokploy by embedding its pages in malicious iframes. This can result in unauthorized changes or actions performed without the user's consent.

Mitigation Strategies

Upgrade Dokploy to version 0.26.6 or later, which includes the patch for the clickjacking vulnerability by adding frame-busting headers to the web interface.

Hi! I’m here to help you understand CVE-2026-24839. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70