CVE-2026-72868
Received Received - Intake

Command Injection in Dokploy

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, secretAccessKey, region, endpoint, provider, and bucket fields from destination.testConnection into an rclone ls command executed through child_process.exec. The `withPermission("destination", "create")` path permits a low-privileged organization member to reach the mutation, close a quoted argument with a crafted field, and execute arbitrary commands in the root Dokploy container, which has access to the host Docker socket. This issue is fixed in version 0.29.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-11
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-72868
EUVD
EUVD-2026-55726

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dokploy dokploy to 0.29.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Dokploy before 0.29.13 has a command injection flaw in its destination.testConnection API. The app interpolates user-controlled fields like accessKey and secretAccessKey directly into an rclone ls command. A low-privileged user can craft input to break out of quotes and execute arbitrary commands in the Dokploy container, which has access to the host Docker socket.

Detection Guidance

Check Dokploy version with: docker ps | grep dokploy. If version is below 0.29.13, the system is vulnerable. Inspect container logs for unexpected command execution patterns or unauthorized access attempts.

Impact Analysis

An attacker with low privileges could gain full control over the Dokploy server, execute arbitrary commands on the host system, and potentially access or modify sensitive data. Since the container has access to the Docker socket, this could lead to container escapes and compromise of other services running on the host.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade Dokploy to version 0.29.13 or later immediately. Restrict low-privileged user access to organization settings. Monitor container activity for suspicious commands or unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72868. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart