CVE-2026-72902

Received Received - Intake

Command Injection in Dokploy Self-Hosted PaaS

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts interpolate the password field into an execAsyncRemote shell command instead of using safeDockerLoginCommand. This issue is fixed in version 0.29.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-72902

EUVD

EUVD-2026-55799

Affected Vendors & Products

Vendor	Product	Version / Range
dokploy	dokploy	to 0.29.13 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability in Dokploy versions before 0.29.13 allows an authenticated user to execute arbitrary commands on a local or SSH-connected server. The issue occurs because the password field is directly interpolated into a shell command without proper sanitization, enabling command injection.

Detection Guidance

Check Dokploy version with: dokploy --version. If version is below 0.29.13, the system is vulnerable. Review registry.testRegistry and registry.testRegistryById API endpoints for unauthorized command execution attempts in logs.

Impact Analysis

An attacker with authenticated access could run malicious commands on the server, potentially leading to full system compromise, data theft, or unauthorized modifications. This could affect the confidentiality, integrity, and availability of the server and its data.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements such as GDPR (data protection) and HIPAA (health information security). Organizations may face legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Dokploy to version 0.29.13 or later immediately. Remove or restrict access to registry.testRegistry and registry.testRegistryById endpoints until patched. Audit logs for signs of exploitation and rotate all credentials stored in Dokploy.

Hi! I’m here to help you understand CVE-2026-72902. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70