CVE-2026-24841: Dokploy WebSocket RCE Vulnerability

CVE-2026-24841 Overview

A critical command injection vulnerability has been identified in Dokploy, a free, self-hostable Platform as a Service (PaaS) solution. The vulnerability exists in Dokploy's WebSocket endpoint /docker-container-terminal, where the containerId and activeWay parameters are directly interpolated into shell commands without proper sanitization. This allows authenticated attackers to execute arbitrary commands on the host server, potentially leading to complete system compromise.

Critical Impact

Authenticated attackers can achieve remote code execution on the host server by injecting malicious commands through unsanitized WebSocket parameters, potentially compromising the entire PaaS infrastructure and all hosted applications.

Affected Products

• Dokploy versions prior to 0.26.6
• Self-hosted Dokploy PaaS installations with WebSocket terminal functionality enabled
• Deployments exposing the /docker-container-terminal WebSocket endpoint

Discovery Timeline

• 2026-01-28 - CVE-2026-24841 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-24841

Vulnerability Analysis

This command injection vulnerability (CWE-78) occurs in the Docker container terminal WebSocket handler within Dokploy. The root cause is the direct interpolation of user-controllable parameters into shell command strings without any input validation or sanitization. When an authenticated user connects to the /docker-container-terminal WebSocket endpoint, they can supply arbitrary values for the containerId and activeWay parameters. These values are then passed directly to shell execution functions, allowing attackers to break out of the intended command context and execute arbitrary system commands.

The network-accessible nature of this vulnerability combined with the low complexity required for exploitation makes it particularly dangerous. An attacker with low-privilege authenticated access can leverage this flaw to execute commands with the privileges of the Dokploy process, typically running with elevated permissions to manage Docker containers.

Root Cause

The vulnerability stems from improper input validation in the WebSocket message handling code within docker-container-terminal.ts. The containerId and activeWay parameters received from WebSocket messages are directly concatenated into shell command strings without escaping special characters or validating against expected patterns. This creates a classic command injection scenario where shell metacharacters (such as ;, |, $(), or backticks) can be used to inject additional commands.

Attack Vector

An attacker must first obtain authenticated access to the Dokploy platform, which requires low-privilege credentials. Once authenticated, the attacker establishes a WebSocket connection to the /docker-container-terminal endpoint. By crafting malicious payloads in the containerId or activeWay parameters containing shell metacharacters and arbitrary commands, the attacker can execute any command on the underlying host system. This could include data exfiltration, lateral movement, persistence establishment, or destruction of hosted services.

The vulnerability is particularly severe in multi-tenant PaaS environments where a single compromised user account could lead to complete infrastructure takeover, affecting all hosted applications and potentially exposing sensitive data from other tenants.

Detection Methods for CVE-2026-24841

Indicators of Compromise

• Unusual WebSocket connections to /docker-container-terminal endpoint with suspicious parameter values
• Shell metacharacters (;, |, &&, ||, backticks, $()) appearing in WebSocket message payloads
• Unexpected process spawning from the Dokploy application process
• Anomalous command execution patterns in system audit logs originating from the Dokploy service

Detection Strategies

• Implement WebSocket traffic inspection to identify payloads containing shell injection patterns in containerId or activeWay parameters
• Deploy application-level logging to capture and alert on WebSocket terminal session parameters
• Monitor for unusual child processes spawned by the Dokploy Node.js process
• Utilize endpoint detection and response (EDR) solutions to detect command injection exploitation attempts

Monitoring Recommendations

• Enable verbose logging for WebSocket connections on the Dokploy platform
• Configure SIEM rules to alert on command injection patterns in application logs
• Monitor Docker API calls for unexpected container operations that could indicate lateral movement
• Implement network segmentation to limit the impact of potential command execution on the host

How to Mitigate CVE-2026-24841

Immediate Actions Required

• Upgrade Dokploy to version 0.26.6 or later immediately
• Audit access logs for the /docker-container-terminal endpoint for any suspicious activity
• Review user accounts with access to the Docker terminal functionality and revoke unnecessary privileges
• Implement network-level restrictions to limit access to the WebSocket terminal endpoint

Patch Information

Dokploy version 0.26.6 addresses this vulnerability by implementing proper input sanitization for the containerId and activeWay parameters before they are used in shell commands. The fix is available in the GitHub commit. Organizations should update to this version or later to remediate the vulnerability. For detailed technical information, refer to the GitHub Security Advisory.

Workarounds

• Disable or restrict access to the /docker-container-terminal WebSocket endpoint until patching is possible
• Implement a web application firewall (WAF) rule to block requests containing shell metacharacters in WebSocket payloads
• Limit network access to the Dokploy management interface to trusted IP ranges only
• Consider running Dokploy in an isolated network segment to limit the blast radius of potential exploitation

# Example: Restrict access to Dokploy management interface using iptables
# Allow only trusted admin IPs to access Dokploy port
iptables -A INPUT -p tcp --dport 3000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP