CVE-2026-72879: Dokploy Platform RCE Vulnerability

CVE-2026-72879 Overview

Dokploy is a free, self-hostable Platform as a Service (PaaS). CVE-2026-72879 is an OS command injection vulnerability [CWE-78] in the getRegistryCommands() function within packages/server/src/utils/cluster/upload.ts. The function interpolates registry.password and registry.registryUrl values directly into a shell command without escaping. An authenticated user with project access can supply malicious registry credentials and trigger a swarm deployment to execute arbitrary operating system commands on the Dokploy server. The issue is fixed in version 0.29.8.

Critical Impact
Authenticated attackers can execute arbitrary OS commands on the Dokploy host, read or modify host files, and pivot to other containers through the Docker socket.

Affected Products

Dokploy versions prior to 0.29.8
Dokploy self-hosted PaaS deployments using swarm registry configuration
Dokploy servers with Docker socket access

Discovery Timeline

2026-08-10 - CVE-2026-72879 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72879

Vulnerability Analysis

The vulnerability resides in Dokploy's cluster upload logic. The getRegistryCommands() function builds a shell command string used to authenticate a Docker registry during swarm deployments. Registry fields, specifically password and registryUrl, are concatenated into the command without shell-safe escaping. When the swarm deployment executes, the shell parses the attacker-controlled substrings, allowing command injection outside the intended docker login invocation. Successful exploitation grants command execution as the Dokploy service user, which typically has access to the Docker daemon and host mount points.

Root Cause

The root cause is unsanitized string interpolation of user-controlled configuration values into a shell command. The original implementation passed registry.password and registry.registryUrl directly through template literals to a shell interpreter. Any metacharacter such as `, $(), ;, or | breaks out of the intended argument context. The fix introduces a safeDockerLoginCommand helper and shell escaping for each interpolated field, along with a sanitizeRegistryError() function that strips passwords from error output.

Attack Vector

Exploitation requires an authenticated Dokploy account with project access. The attacker configures a registry entry with a malicious password or registryUrl value containing shell metacharacters. Triggering a swarm deployment causes Dokploy to execute the crafted command, running attacker code on the host. From there, the attacker can access host files or use the Docker socket to control other containers.

typescript

// Security patch excerpt from packages/server/src/services/registry.ts
// Adds password sanitization and a safe docker login builder
return `printf %s ${escapedPassword} | docker login ${escapedRegistry} -u ${escapedUser} --password-stdin`;
}

function sanitizeRegistryError(
	error: unknown,
	password: string | null | undefined,
): string {
	const message =
		error instanceof Error ? error.message : "Error with registry login";
	if (!password) return message;
	return message.split(password).join("***");
}

Source: GitHub Commit 1f4f940

Detection Methods for CVE-2026-72879

Indicators of Compromise

Registry entries containing shell metacharacters such as `, $(, ;, &&, or | in the password or registryUrl fields.
Unexpected child processes spawned by the Dokploy Node.js process during swarm deployment operations.
Outbound network connections from the Dokploy host to unknown hosts immediately following a registry configuration change.
New or modified files under /root, /etc, or Docker volume mount paths without an associated legitimate deployment.

Detection Strategies

Audit the Dokploy application database for registry records where the password or registryUrl fields contain shell metacharacters.
Monitor process execution telemetry for sh -c or docker login invocations whose arguments contain suspicious substrings.
Correlate swarm deployment events with subsequent process creations to identify anomalous command chains.

Monitoring Recommendations

Enable process-level logging on Dokploy hosts and alert on non-Docker child processes launched by the Dokploy service.
Log all Docker socket API calls and flag container-create or exec operations that originate outside normal deployment flows.
Track modifications to registry credentials through Dokploy audit logs and require review of credential changes.

How to Mitigate CVE-2026-72879

Immediate Actions Required

Upgrade Dokploy to version 0.29.8 or later, which introduces safeDockerLoginCommand and shell-safe escaping.
Rotate all registry credentials stored in Dokploy after upgrading, since prior passwords may have been exposed in error output.
Review project membership and remove accounts that do not require registry configuration privileges.
Inspect existing registry entries for shell metacharacters and delete any suspicious records.

Patch Information

The fix is available in Dokploy release v0.29.8 and was merged through Pull Request #4579. Full technical details are documented in GHSA-prwq-2mcm-mvhr. The commit 1f4f9404 introduces shell escaping for registry fields and sanitizes registry passwords from error messages.

Workarounds

Restrict Dokploy project access to trusted operators until the upgrade to 0.29.8 is complete.
Disable the ability to add or edit registry credentials for non-administrator roles.
Isolate the Dokploy host on a dedicated network segment to limit lateral movement if exploitation occurs.

bash

# Upgrade Dokploy to the patched version
docker pull dokploy/dokploy:0.29.8
docker service update --image dokploy/dokploy:0.29.8 dokploy

# Verify running version
docker service inspect dokploy --format '{{.Spec.TaskTemplate.ContainerSpec.Image}}'