CVE-2026-24839: Dokploy Clickjacking CSRF Vulnerability

CVE-2026-24839 Overview

CVE-2026-24839 is a Clickjacking vulnerability affecting Dokploy, a free, self-hostable Platform as a Service (PaaS). The Dokploy web interface in versions prior to 0.26.6 lacks proper frame-busting headers, making it susceptible to UI redress attacks. Attackers can embed Dokploy pages within malicious iframes on attacker-controlled websites, potentially tricking authenticated users into performing unintended actions without their knowledge.

Critical Impact

Authenticated Dokploy users may unknowingly perform sensitive administrative actions when visiting attacker-controlled websites that embed the vulnerable Dokploy interface in hidden iframes.

Affected Products

• Dokploy versions prior to 0.26.6

Discovery Timeline

• 2026-01-28 - CVE CVE-2026-24839 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-24839

Vulnerability Analysis

This vulnerability falls under CWE-1021 (Improper Restriction of Rendered UI Layers or Frames). The Dokploy web interface failed to implement security headers that prevent the application from being embedded within iframes on external domains. Without these protections, an attacker can create a malicious webpage that loads the Dokploy interface in a transparent iframe overlaid on seemingly innocuous content.

When an authenticated user visits the malicious page, their clicks intended for the visible content are instead captured by the invisible Dokploy interface. This technique, known as Clickjacking or UI redressing, can lead to unintended actions such as modifying configurations, deploying applications, or changing security settings within the Dokploy platform.

Root Cause

The root cause of this vulnerability is the absence of frame-busting security headers in the Dokploy web application's HTTP responses. Specifically, the application did not set the X-Frame-Options header or implement a Content Security Policy (CSP) with the frame-ancestors directive. These headers instruct browsers to block the page from being rendered inside frames on unauthorized domains.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker must:

1. Create a malicious webpage containing a hidden iframe pointing to a Dokploy instance
2. Overlay deceptive UI elements to encourage user clicks
3. Lure an authenticated Dokploy user to visit the malicious page
4. The user's clicks on visible elements are redirected to the hidden Dokploy interface

The following patch was applied to apps/dokploy/next.config.mjs to remediate the vulnerability:

	async headers() {
		return [
			{
				// Apply security headers to all routes
				source: "/:path*",
				headers: [
					{
						key: "X-Frame-Options",
						value: "DENY",
					},
					{
						key: "Content-Security-Policy",
						value: "frame-ancestors 'none'",
					},
					{
						key: "X-Content-Type-Options",
						value: "nosniff",
					},
					{
						key: "Referrer-Policy",
						value: "strict-origin-when-cross-origin",
					},
				],
			},
		];
	},

Source: GitHub Commit Update

This patch adds comprehensive security headers including X-Frame-Options: DENY to block all framing attempts and Content-Security-Policy: frame-ancestors 'none' as a modern CSP-based protection mechanism.

Detection Methods for CVE-2026-24839

Indicators of Compromise

• Web server logs showing referrer headers from suspicious external domains when accessing Dokploy administrative functions
• Unexpected configuration changes or deployments triggered without administrator knowledge
• User reports of being redirected to unfamiliar websites before noticing changes in their Dokploy environment

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests with suspicious referrer headers
• Monitor HTTP response headers to verify that X-Frame-Options and CSP frame-ancestors directives are properly set
• Review Dokploy audit logs for administrative actions that correlate with users accessing external websites
• Use browser developer tools or security scanners to verify frame protection headers are present

Monitoring Recommendations

• Enable detailed logging of all administrative actions within Dokploy
• Configure alerting for sensitive operations such as deployment changes, user management, and security setting modifications
• Implement Content Security Policy reporting to receive notifications of framing attempts

How to Mitigate CVE-2026-24839

Immediate Actions Required

• Upgrade Dokploy to version 0.26.6 or later immediately
• Verify that security headers are being served by testing with browser developer tools or online header checkers
• Review recent administrative actions for any unauthorized changes
• Educate users about the risks of clicking links from untrusted sources while authenticated to Dokploy

Patch Information

The vulnerability is patched in Dokploy version 0.26.6. The fix was implemented through GitHub Pull Request #3500 and the specific commit can be found at GitHub Commit 9714695. For complete details, refer to the GitHub Security Advisory GHSA-c94j-8wgf-2q9q.

Workarounds

• If immediate upgrade is not possible, configure a reverse proxy (nginx, Apache, Traefik) in front of Dokploy to inject the necessary security headers
• Restrict network access to Dokploy to trusted IP ranges or VPN connections only
• Implement browser extensions that provide clickjacking protection for administrative sessions

# Example nginx configuration to add frame-busting headers
location / {
    add_header X-Frame-Options "DENY" always;
    add_header Content-Security-Policy "frame-ancestors 'none'" always;
    add_header X-Content-Type-Options "nosniff" always;
    proxy_pass http://dokploy-backend;
}