CVE-2026-45633: Dokploy RCE Vulnerability

CVE-2026-45633 Overview

CVE-2026-45633 is a command injection vulnerability in Dokploy, a free self-hostable Platform as a Service (PaaS). The flaw affects versions 0.26.6 and earlier. The /docker-container-logs WebSocket endpoint accepts tail and since parameters and concatenates them directly into shell commands without validation. Authenticated users can inject arbitrary shell commands that execute with root privileges on the host running Dokploy. The issue is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
Any authenticated Dokploy user can execute arbitrary OS commands as root through the docker container logs WebSocket, leading to full host compromise.

Affected Products

Dokploy versions 0.26.6 and earlier
Self-hosted Dokploy PaaS deployments
Docker hosts managed by vulnerable Dokploy instances

Discovery Timeline

2026-05-29 - CVE-2026-45633 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-45633

Vulnerability Analysis

The vulnerability resides in the /docker-container-logs WebSocket endpoint in Dokploy. The endpoint exposes container log retrieval functionality and accepts user-supplied tail and since parameters. These parameters are passed unsanitized into a shell command string that Dokploy executes against the Docker daemon. Because the input is not validated, escaped, or passed as separate argv elements, an attacker can break out of the intended command context using standard shell metacharacters such as ;, &&, |, or command substitution syntax. The Dokploy process runs as root to manage Docker, so injected commands inherit root privileges on the host.

Root Cause

The root cause is improper neutralization of OS command elements [CWE-78]. Parameter values for tail and since flow from the WebSocket message handler into shell command construction via string concatenation rather than parameterized invocation. No allowlist, type check, or argument escaping is applied before the command reaches the shell.

Attack Vector

Exploitation requires network access to the Dokploy WebSocket endpoint and a valid authenticated session. Once authenticated, an attacker connects to /docker-container-logs and supplies a crafted tail or since value containing shell metacharacters and an arbitrary command payload. The server concatenates the value into a docker logs command and executes the combined string through a shell, running the injected payload as root. No user interaction is required beyond authentication, and the scope changes because root command execution on the Docker host extends impact beyond the Dokploy application itself.

No verified proof-of-concept code is published. See the Dokploy GitHub Security Advisory GHSA-wmqj-wr9q-327p for vendor technical details.

Detection Methods for CVE-2026-45633

Indicators of Compromise

WebSocket connections to /docker-container-logs containing shell metacharacters (;, &&, |, `, $() in tail or since query parameters or message payloads.
Unexpected child processes spawned by the Dokploy server process, particularly shells (sh, bash) invoking utilities such as curl, wget, nc, or chmod.
New cron jobs, SSH keys, or systemd units created on the Dokploy host outside of normal deployment activity.

Detection Strategies

Inspect Dokploy reverse proxy and application logs for /docker-container-logs requests with non-numeric tail or since values.
Apply process-lineage detection to flag shells or network tools spawned by the Dokploy Node.js process.
Monitor the Docker host for outbound connections initiated by the Dokploy user immediately following WebSocket activity.

Monitoring Recommendations

Forward Dokploy application, reverse proxy, and Docker host audit logs to a central log platform for correlation.
Alert on file integrity changes under /root, /etc/cron*, /etc/systemd/system/, and ~/.ssh/authorized_keys on Dokploy hosts.
Track authenticated user sessions in Dokploy and correlate session identifiers with WebSocket endpoint usage to identify abuse.

How to Mitigate CVE-2026-45633

Immediate Actions Required

Upgrade Dokploy to a version later than 0.26.6 as soon as a fixed release is available from the maintainers.
Restrict network access to the Dokploy management interface using a VPN, bastion host, or IP allowlist.
Audit Dokploy user accounts and remove or rotate credentials for any account that is not strictly required.
Review Docker host logs and shell history for signs of prior exploitation, including unexpected outbound connections and persistence artifacts.

Patch Information

Refer to the Dokploy GitHub Security Advisory GHSA-wmqj-wr9q-327p for the fixed version and patch details. Apply the upgrade on every self-hosted Dokploy instance and verify the running version after deployment.

Workarounds

Block external access to the /docker-container-logs WebSocket path at the reverse proxy until patching is complete.
Disable or revoke access for non-administrative Dokploy accounts that do not require log viewing.
Place the Dokploy host behind a network segment that only trusted administrators can reach.

bash

# Example NGINX block to deny the vulnerable endpoint until patched
location /docker-container-logs {
    deny all;
    return 403;
}