CVE-2026-72862: Dokploy Platform RCE Vulnerability

CVE-2026-72862 Overview

Dokploy is a free, self-hostable Platform as a Service (PaaS) for deploying applications and databases. CVE-2026-72862 is a command injection vulnerability [CWE-78] affecting Dokploy versions prior to 0.29.13. The database service deployment functions in mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts pass user-controlled dockerImage fields unquoted into docker pull ${dockerImage} shell commands on the remote-server code path. Authenticated attackers with permission to create database services can inject arbitrary shell commands executed on remote deployment targets.

Critical Impact
Authenticated users can execute arbitrary shell commands on remote Dokploy deployment servers, leading to full compromise of managed infrastructure.

Affected Products

Dokploy versions prior to 0.29.13
Database deployment services: mariadb.ts, mongo.ts, mysql.ts
Database deployment services: postgres.ts, redis.ts, libsql.ts

Discovery Timeline

2026-08-10 - CVE-2026-72862 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-72862

Vulnerability Analysis

The vulnerability exists in Dokploy's remote-server deployment code path for database services. Six database service files construct docker pull shell commands using string interpolation of the dockerImage field. Because the value is not quoted or escaped, an authenticated user can supply metacharacters such as ;, &&, |, or $() inside the dockerImage value to break out of the intended command context.

When the deployment function executes execAsyncRemote, the injected payload runs on the remote Docker host with the privileges of the Dokploy execution context. This grants the attacker code execution outside the intended container-image pull operation, on the remote deployment target rather than the Dokploy control plane.

Root Cause

The root cause is missing shell quoting when interpolating user-controlled input into a shell command string. Dokploy accepted the dockerImage field from API input and passed it directly to a remote shell without escaping. The patch introduces the shell-quote library's quote function to safely escape the value before command construction.

Attack Vector

An authenticated attacker with permission to create or modify a database service submits a crafted dockerImage value containing shell metacharacters. The value is transmitted through the Dokploy API and reaches one of the six affected TypeScript service handlers. When the deployment is triggered, execAsyncRemote runs the composed command on the target remote server, executing the attacker payload.

typescript

// Patch applied to packages/server/src/services/libsql.ts and mariadb.ts
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, getTableColumns } from "drizzle-orm";
+import { quote } from "shell-quote";
 import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";
// Source: https://github.com/Dokploy/dokploy/commit/b24202e69b244f0ece8d2f56e99cad9bb5e1a248
// The fix imports `quote` from shell-quote and applies it to dockerImage
// before it is interpolated into the remote `docker pull` command.

Detection Methods for CVE-2026-72862

Indicators of Compromise

Unexpected child processes spawned by the Dokploy remote-server user following a docker pull invocation.
Database service records containing shell metacharacters (;, &&, |, backticks, $()) in the dockerImage field.
Outbound network connections from Dokploy-managed remote hosts to attacker-controlled infrastructure shortly after service creation.

Detection Strategies

Audit Dokploy API and database records for stored dockerImage values that do not match the expected image[:tag]@digest pattern.
Monitor execAsyncRemote call sites and shell histories on remote servers for command strings that deviate from the standard docker pull <image> shape.
Alert on process lineage where docker pull is the parent of shells, interpreters (bash, sh, python, curl, wget), or reverse-shell tools.

Monitoring Recommendations

Enable command-line logging on Dokploy remote hosts and centralize logs for review.
Correlate Dokploy audit events for database service creation with process telemetry from the target remote server.
Track version telemetry across Dokploy installations and flag any node running a version below 0.29.13.

How to Mitigate CVE-2026-72862

Immediate Actions Required

Upgrade all Dokploy installations to version 0.29.13 or later without delay.
Restrict who holds database service creation privileges in Dokploy to trusted operators only.
Review recent database service deployments for suspicious dockerImage values and rotate credentials on affected remote hosts.

Patch Information

The vulnerability is fixed in Dokploy 0.29.13. The fix imports the quote function from the shell-quote package and applies it to the dockerImage value before it is interpolated into the docker pull shell command. See the GitHub Security Advisory GHSA-6jrh-8qmg-jj3p, the GitHub Release v0.29.13, and the remediation commit.

Workarounds

If patching is not immediately possible, temporarily revoke database service creation permissions from non-administrative Dokploy users.
Place remote Dokploy deployment targets behind network segmentation to limit lateral movement if command injection succeeds.
Enforce strict input validation at any reverse proxy or API gateway fronting Dokploy to reject dockerImage values containing shell metacharacters.

bash

# Upgrade Dokploy to the patched release
curl -sSL https://dokploy.com/install.sh | sh
# Verify version is 0.29.13 or later
docker exec dokploy sh -c 'cat /app/package.json | grep version'