CVE-2026-24840
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2026-01-28

Last updated on: 2026-02-04

Assigner: GitHub, Inc.

Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a hardcoded credential in the provided installation script (located at https://dokploy.com/install.sh, line 154) uses a hardcoded password when creating the database container. This means that nearly all Dokploy installations use the same database credentials and could be compromised. Version 0.26.6 contains a patch for the issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-28
Last Modified
2026-02-04
Generated
2026-06-16
AI Q&A
2026-01-29
EPSS Evaluated
2026-06-15
NVD
CVE-2026-24840
EUVD
EUVD-2026-4905
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
dokploy dokploy to 0.26.6 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-798 The product contains hard-coded credentials, such as a password or cryptographic key.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability involves a hardcoded credential in the installation script of Dokploy versions prior to 0.26.6. Specifically, the script uses a hardcoded password when creating the database container, meaning that nearly all Dokploy installations use the same database credentials. This uniformity in credentials can allow attackers to compromise the database.

Impact Analysis

Because nearly all Dokploy installations use the same hardcoded database credentials, an attacker could exploit this to gain unauthorized access to the database. This could lead to a full compromise of confidentiality, integrity, and availability of the data stored in the database.

Mitigation Strategies

Upgrade Dokploy to version 0.26.6 or later, which contains a patch that removes the hardcoded database credentials vulnerability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24840. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart