CVE-2026-24839: Dokploy Clickjacking CSRF Vulnerability

CVE-2026-24839 Overview

CVE-2026-24839 is a Clickjacking vulnerability affecting Dokploy, a free, self-hostable Platform as a Service (PaaS). The Dokploy web interface in versions prior to 0.26.6 lacks proper frame-busting headers, making it susceptible to UI redress attacks. Attackers can embed Dokploy pages within malicious iframes on attacker-controlled websites, potentially tricking authenticated users into performing unintended actions without their knowledge.

Critical Impact
Authenticated Dokploy users may unknowingly perform sensitive administrative actions when visiting attacker-controlled websites that embed the vulnerable Dokploy interface in hidden iframes.

Affected Products

Dokploy versions prior to 0.26.6

Discovery Timeline

2026-01-28 - CVE CVE-2026-24839 published to NVD
2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-24839

Vulnerability Analysis

This vulnerability falls under CWE-1021 (Improper Restriction of Rendered UI Layers or Frames). The Dokploy web interface failed to implement security headers that prevent the application from being embedded within iframes on external domains. Without these protections, an attacker can create a malicious webpage that loads the Dokploy interface in a transparent iframe overlaid on seemingly innocuous content.

When an authenticated user visits the malicious page, their clicks intended for the visible content are instead captured by the invisible Dokploy interface. This technique, known as Clickjacking or UI redressing, can lead to unintended actions such as modifying configurations, deploying applications, or changing security settings within the Dokploy platform.

Root Cause

The root cause of this vulnerability is the absence of frame-busting security headers in the Dokploy web application's HTTP responses. Specifically, the application did not set the X-Frame-Options header or implement a Content Security Policy (CSP) with the frame-ancestors directive. These headers instruct browsers to block the page from being rendered inside frames on unauthorized domains.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker must:

Create a malicious webpage containing a hidden iframe pointing to a Dokploy instance
Overlay deceptive UI elements to encourage user clicks
Lure an authenticated Dokploy user to visit the malicious page
The user's clicks on visible elements are redirected to the hidden Dokploy interface

The following patch was applied to apps/dokploy/next.config.mjs to remediate the vulnerability:

javascript

	async headers() {
		return [
			{
				// Apply security headers to all routes
				source: "/:path*",
				headers: [
					{
						key: "X-Frame-Options",
						value: "DENY",
					},
					{
						key: "Content-Security-Policy",
						value: "frame-ancestors 'none'",
					},
					{
						key: "X-Content-Type-Options",
						value: "nosniff",
					},
					{
						key: "Referrer-Policy",
						value: "strict-origin-when-cross-origin",
					},
				],
			},
		];
	},

Source: GitHub Commit Update

This patch adds comprehensive security headers including X-Frame-Options: DENY to block all framing attempts and Content-Security-Policy: frame-ancestors 'none' as a modern CSP-based protection mechanism.

Detection Methods for CVE-2026-24839

Indicators of Compromise

Web server logs showing referrer headers from suspicious external domains when accessing Dokploy administrative functions
Unexpected configuration changes or deployments triggered without administrator knowledge
User reports of being redirected to unfamiliar websites before noticing changes in their Dokploy environment

Detection Strategies

Implement web application firewall (WAF) rules to detect and block requests with suspicious referrer headers
Monitor HTTP response headers to verify that X-Frame-Options and CSP frame-ancestors directives are properly set
Review Dokploy audit logs for administrative actions that correlate with users accessing external websites
Use browser developer tools or security scanners to verify frame protection headers are present

Monitoring Recommendations

Enable detailed logging of all administrative actions within Dokploy
Configure alerting for sensitive operations such as deployment changes, user management, and security setting modifications
Implement Content Security Policy reporting to receive notifications of framing attempts

How to Mitigate CVE-2026-24839

Immediate Actions Required

Upgrade Dokploy to version 0.26.6 or later immediately
Verify that security headers are being served by testing with browser developer tools or online header checkers
Review recent administrative actions for any unauthorized changes
Educate users about the risks of clicking links from untrusted sources while authenticated to Dokploy

Patch Information

The vulnerability is patched in Dokploy version 0.26.6. The fix was implemented through GitHub Pull Request #3500 and the specific commit can be found at GitHub Commit 9714695. For complete details, refer to the GitHub Security Advisory GHSA-c94j-8wgf-2q9q.

Workarounds

If immediate upgrade is not possible, configure a reverse proxy (nginx, Apache, Traefik) in front of Dokploy to inject the necessary security headers
Restrict network access to Dokploy to trusted IP ranges or VPN connections only
Implement browser extensions that provide clickjacking protection for administrative sessions

bash

# Example nginx configuration to add frame-busting headers
location / {
    add_header X-Frame-Options "DENY" always;
    add_header Content-Security-Policy "frame-ancestors 'none'" always;
    add_header X-Content-Type-Options "nosniff" always;
    proxy_pass http://dokploy-backend;
}