CVE-2026-72877: Dokploy Command Injection RCE Vulnerability

CVE-2026-72877 Overview

CVE-2026-72877 is a command injection vulnerability [CWE-78] affecting Dokploy, a free self-hostable Platform as a Service (PaaS). The dockerImage field is interpolated without quoting into shell commands in the buildRemoteDocker() function located in packages/server/src/utils/providers/docker.ts. The field is validated only as an optional string, allowing shell metacharacter injection. An authenticated user with application create or update permission can inject shell command substitution syntax to execute arbitrary commands on the local build host or a remote SSH build target. The issue affects all versions prior to 0.29.13 and is fixed in 0.29.13.

Critical Impact
Authenticated users can execute arbitrary shell commands on the Dokploy build host or remote SSH targets, exposing host secrets and cross-tenant project data.

Affected Products

Dokploy versions prior to 0.29.13
Deployments using local Docker build hosts
Deployments using remote SSH build targets

Discovery Timeline

2026-08-10 - CVE-2026-72877 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-72877

Vulnerability Analysis

The vulnerability resides in Dokploy's Docker build pipeline. The buildRemoteDocker() function constructs shell commands by directly interpolating the user-supplied dockerImage value into a command string. Because the input validator treats the field as an optional string with no character restrictions, an attacker can supply shell metacharacters such as backticks or $() for command substitution.

When the crafted image name reaches the shell, the substitution executes before the intended docker command runs. The resulting commands execute with the privileges of the Dokploy build process, granting access to environment variables, mounted secrets, and adjacent project workspaces on the shared build host.

Root Cause

The root cause is missing shell-quoting of untrusted input during command construction, combined with a permissive schema validator. Dokploy relied on string typing rather than allowlisting a Docker image reference grammar, so any string, including one containing $(...) or `...` sequences, passed validation and reached sh -c unescaped.

Attack Vector

An authenticated user with application create or update permission submits an application configuration whose dockerImage field contains a shell command substitution payload. When Dokploy triggers a build, the injected command executes on the build host, or on a remote SSH target if configured. Because Dokploy is multi-tenant by design, compromising the build host exposes secrets and source artifacts belonging to other projects on the same instance.

typescript

// Security patch — packages/server/src/utils/builders/docker-file.ts
// fix(security): escape user input in docker build/pull commands

 		}
 
 		command += `
-echo "Building ${appName}" ;
-cd ${dockerContextPath} || {
-  echo "❌ The path ${dockerContextPath} does not exist" ;
+echo ${quote([`Building ${appName}`])} ;
+cd ${quote([dockerContextPath])} || {
+  echo ${quote([`❌ The path ${dockerContextPath} does not exist`])} ;
   exit 1;
 }

Source: GitHub Commit cba0b25

The patch introduces the shell-quote library's quote() function to escape every user-influenced value before it is embedded in the generated shell script. A parallel change is applied to packages/server/src/utils/builders/nixpacks.ts.

Detection Methods for CVE-2026-72877

Indicators of Compromise

Application configurations containing $(, `, ;, &&, or | characters in the dockerImage field
Unexpected outbound network connections originating from the Dokploy build host during a build
Build logs containing output from commands not present in Dockerfiles, such as id, whoami, or cat /etc/passwd
Access to environment files, SSH keys, or .env artifacts belonging to unrelated projects

Detection Strategies

Audit the Dokploy database for existing applications with non-standard characters in the dockerImage column
Enable and centralize shell audit logging on Dokploy build hosts and remote SSH build targets
Review build job logs for shell metacharacter execution that does not correspond to a valid image reference
Correlate application create and update API events with subsequent process spawns on the build host

Monitoring Recommendations

Forward Dokploy application logs and host process telemetry to a centralized analytics pipeline for correlation
Alert on new child processes of the Dokploy server or Docker CLI that are not part of the expected build toolchain
Monitor authenticated Dokploy API activity for privilege changes and rapid application configuration edits

How to Mitigate CVE-2026-72877

Immediate Actions Required

Upgrade Dokploy to version 0.29.13 or later on all instances, including remote SSH build targets
Rotate all secrets, API tokens, and SSH keys stored on or accessible to the Dokploy build host
Review the user roster and revoke application create or update permissions for accounts that do not require them
Inspect existing application definitions for malicious dockerImage values and remove or sanitize them before the next build

Patch Information

The fix is available in Dokploy v0.29.13. The corresponding pull request is PR #4860 and the vendor advisory is GHSA-jxxj-gmpx-h5rj. The patch adds shell-quote escaping to every user-controlled value interpolated into build shell commands.

Workarounds

Restrict application create and update permissions to a small set of trusted operators until the upgrade is applied
Place Dokploy behind an authenticating reverse proxy and disable public registration to reduce the pool of authenticated users
Run Dokploy build hosts in isolated environments with per-project credentials so cross-tenant secret exposure is limited

bash

# Upgrade Dokploy to the patched release
docker service update --image dokploy/dokploy:v0.29.13 dokploy

# Verify the running version
docker exec $(docker ps -qf name=dokploy) dokploy --version