CVE-2026-72867: Dokploy Platform RCE Vulnerability

CVE-2026-72867 Overview

CVE-2026-72867 is a command injection vulnerability in Dokploy, a self-hostable Platform as a Service (PaaS). The flaw affects versions 0.29.3 through 0.29.12 and stems from an incomplete fix for CVE-2026-45628. The branch fields defined in packages/server/src/db/schema/compose.ts lack server-side validation. A low-privileged authenticated user can issue a compose.update request storing a malicious value in customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. Invoking compose.deploy then passes the value into shell-based git clone commands, producing arbitrary host command execution.

Critical Impact
Any authenticated Dokploy user can execute arbitrary commands on the host running the PaaS control plane, leading to full server compromise.

Affected Products

Dokploy 0.29.3 through 0.29.12
Fixed in Dokploy 0.29.13
Self-hosted Dokploy PaaS deployments

Discovery Timeline

2026-08-10 - CVE-2026-72867 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-72867

Vulnerability Analysis

Dokploy exposes compose configuration through a tRPC API. The compose.update mutation persists user-controlled branch identifiers into the compose schema without validating them against a safe character set. When the operator or another authenticated user later triggers compose.deploy, the stored branch value is interpolated into a shell command that invokes git clone with the --branch flag.

Because the branch string is concatenated into a shell invocation rather than passed as a properly escaped argument, characters such as ;, `, $(), and && are interpreted by the shell. The provider modules git.ts, github.ts, gitlab.ts, bitbucket.ts, and gitea.ts all shared this unsafe pattern. This qualifies as CWE-20 Improper Input Validation and functions as an OS command injection.

Root Cause

The original remediation for CVE-2026-45628 sanitized some entry points but did not extend validation to the persisted branch fields in packages/server/src/db/schema/compose.ts. Values written through compose.update bypass any client-side controls and reach the deploy pipeline verbatim, where they are treated as trusted input by the Git provider helpers.

Attack Vector

An attacker with any authenticated account and permission to modify a compose resource submits a crafted branch value. On the next deploy, the malicious payload executes with the privileges of the Dokploy server process, giving the attacker code execution on the host, access to secrets, and control over other tenants managed by the platform.

typescript

// Patch excerpt from packages/server/src/utils/providers/git.ts
// fix(security): escape user input in git clone commands across all providers
 	updateSSHKeyById,
 } from "@dokploy/server/services/ssh-key";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
+import { shellWord } from "./utils";
 
 interface CloneGitRepository {
 	appName: string;
// Source: https://github.com/Dokploy/dokploy/commit/47347ab885b0ad1f5d0ef0e5e74bbba35c7f93bc

The fix introduces a shellWord helper that quotes user-supplied values before they are placed into shell commands. The same import was added across the Bitbucket, GitHub, GitLab, and Gitea provider modules.

Detection Methods for CVE-2026-72867

Indicators of Compromise

Unexpected child processes spawned by the Dokploy server process, particularly shells (sh, bash) invoked outside normal git clone operations.
Compose records containing shell metacharacters (;, |, `, $(, &&) in customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch fields.
Outbound network connections initiated by the Dokploy host to unfamiliar destinations shortly after a deploy event.

Detection Strategies

Query the Dokploy database for compose rows whose branch fields do not match a strict [A-Za-z0-9._/-]+ pattern.
Review tRPC access logs for compose.update calls originating from low-privileged accounts followed by compose.deploy.
Correlate deployment events with process telemetry to identify anomalous command lines derived from git clone --branch.

Monitoring Recommendations

Enable audit logging on all compose.update and compose.deploy operations, including the pre-change and post-change branch values.
Alert on any Dokploy process spawning interpreters (python, perl, curl | sh) or writing to /etc, /root, or user home directories.
Watch for new SSH keys, cron entries, or systemd units created on Dokploy hosts after a deploy.

How to Mitigate CVE-2026-72867

Immediate Actions Required

Upgrade Dokploy to version 0.29.13 or later, which introduces the shellWord escaping helper across all Git providers.
Audit existing compose records and remove any stored branch values containing shell metacharacters before deploying again.
Rotate credentials, deploy keys, and API tokens that were accessible to the Dokploy host during the vulnerable window.

Patch Information

The vendor released the fix in Dokploy v0.29.13. The code change is tracked in GitHub Pull Request #4855 and merged via commit 47347ab. Full technical background is available in GitHub Security Advisory GHSA-cg8g-x23v-5fw8.

Workarounds

Restrict compose.update permissions to trusted administrators until the upgrade is deployed.
Place the Dokploy control plane behind a network boundary that limits access to authenticated operators only.
Manually enforce branch name validation at a reverse proxy or WAF layer by rejecting requests containing shell metacharacters in compose payloads.

bash

# Upgrade to the patched release
docker pull dokploy/dokploy:0.29.13
docker compose -f /etc/dokploy/docker-compose.yml up -d

# Verify the running version
curl -s http://127.0.0.1:3000/api/version