CVE-2026-72735: Dokploy Platform RCE Vulnerability

CVE-2026-72735 Overview

Dokploy is a free, self-hostable Platform as a Service (PaaS) used to deploy and manage applications across remote servers. CVE-2026-72735 is a command injection vulnerability [CWE-77] in Dokploy versions prior to 0.29.13. The writeTraefikConfigRemote function in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the result into an echo command executed through execAsyncRemote. Attackers with authenticated access can inject single quotes through redirect regex fields, basic authentication usernames, domain host values, or middleware configuration to execute arbitrary commands on managed remote servers. The flaw represents an incomplete fix for CVE-2026-45630.

Critical Impact
Authenticated attackers can execute arbitrary shell commands on managed remote servers with the configured SSH user's privileges, compromising the entire Dokploy-managed fleet.

Affected Products

Dokploy versions prior to 0.29.13
packages/server/src/utils/traefik/application.ts (writeTraefikConfigRemote function)
Dokploy-managed remote servers reachable via SSH

Discovery Timeline

2026-08-10 - CVE-2026-72735 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72735

Vulnerability Analysis

Dokploy writes Traefik reverse proxy configuration to managed remote servers by serializing configuration objects to YAML, then shell-interpolating the resulting string into a remote echo command. Because the YAML string is placed inside single quotes in the constructed shell command, any single-quote character within the serialized YAML terminates the quoted string and allows subsequent characters to be interpreted as shell syntax.

The injection reaches execAsyncRemote, which dispatches the command over SSH to remote hosts. Successful exploitation runs attacker-supplied commands under the SSH user configured for the target server. In typical Dokploy deployments this SSH user has broad privileges over container hosts, allowing lateral movement, credential theft, and manipulation of hosted applications.

This vulnerability is an incomplete fix of CVE-2026-45630. The original patch did not sanitize all user-controllable fields that flow into the Traefik configuration.

Root Cause

The root cause is unsafe shell interpolation of user-controlled data. YAML serialization does not escape shell metacharacters, and single quotes in fields such as redirect regex, redirect replacement, basic-auth usernames, domain host values, and middleware configuration break out of the outer single-quoted echo argument.

Attack Vector

An authenticated user with permission to create or modify an application, domain, or middleware supplies a value containing single quotes and shell metacharacters. When Dokploy writes the Traefik configuration to a remote host, the injected payload is executed on that host.

typescript

 import { createInterface } from "node:readline";
 import { paths } from "@dokploy/server/constants";
 import type { Domain } from "@dokploy/server/services/domain";
+import { quote } from "shell-quote";
 import { parse, stringify } from "yaml";
 import { encodeBase64 } from "../docker/utils";
 import { execAsync, execAsyncRemote } from "../process/execAsync";

Source: GitHub commit 92310dd. The patch introduces shell-quote and switches remote writes to base64-encoded payloads with escaped config paths, eliminating shell interpolation of the YAML string.

Detection Methods for CVE-2026-72735

Indicators of Compromise

Unexpected child processes spawned by the Dokploy SSH user on managed remote hosts following Traefik configuration updates.
Traefik dynamic configuration entries containing single quotes, backticks, $(, or ; in redirect regex, host, or basic-auth fields.
Outbound network connections originating from Dokploy-managed hosts to unknown destinations shortly after application or domain changes.
Modifications to authorized_keys, cron files, or Traefik config directories on managed remote hosts.

Detection Strategies

Audit Dokploy application, domain, and middleware records for fields containing shell metacharacters, particularly single quotes and command substitution syntax.
Correlate Dokploy API write operations with process-execution telemetry on remote hosts to identify commands not matching the expected echo | tee pattern.
Review SSH session logs on managed servers for commands issued by the Dokploy SSH user that deviate from Traefik file-write operations.

Monitoring Recommendations

Enable process-execution and command-line logging on all Dokploy-managed remote hosts.
Alert on any writes to Traefik configuration directories that are not immediately preceded by an authenticated Dokploy API call.
Track version banners of Dokploy instances and flag any host still running versions prior to 0.29.13.

How to Mitigate CVE-2026-72735

Immediate Actions Required

Upgrade all Dokploy control-plane instances to version 0.29.13 or later without delay.
Rotate SSH keys used by Dokploy to manage remote hosts, and review authorized_keys files on those hosts for unauthorized additions.
Audit user accounts on the Dokploy instance and remove any accounts with unnecessary write access to applications, domains, or middleware.
Inspect existing Traefik dynamic configuration files on managed remote hosts for injected payloads.

Patch Information

The issue is fixed in Dokploy 0.29.13. The fix, delivered in commit 92310dd, imports shell-quote, base64-encodes the remote Traefik YAML payload, and escapes configuration paths so user-controlled data is no longer interpolated into a shell command. Details are available in the GHSA-478p-cx3j-hghc advisory and the v0.29.13 release notes.

Workarounds

Restrict Dokploy application, domain, and middleware editing privileges to a minimal set of trusted operators until the patch is applied.
Constrain the SSH user Dokploy uses on managed remote hosts to the least privilege necessary, and isolate managed hosts on segmented networks.
Place Dokploy administrative interfaces behind VPN or IP allowlists to reduce exposure of authenticated write endpoints.

bash

# Upgrade Dokploy to the patched release
docker pull dokploy/dokploy:0.29.13
docker service update --image dokploy/dokploy:0.29.13 dokploy

# Verify installed version
docker exec $(docker ps -qf name=dokploy) dokploy --version