CVE-2026-72881: Dokploy Command Injection RCE Vulnerability

CVE-2026-72881 Overview

CVE-2026-72881 is a command injection vulnerability [CWE-78] in Dokploy, a self-hostable Platform as a Service (PaaS). Versions prior to 0.29.13 interpolate database names, usernames, and passwords into nested shell command strings passed to child_process.exec() in the backup and restore utilities. An authenticated administrator with permission to create databases and configure backups can craft configuration fields that execute arbitrary commands inside PostgreSQL, MariaDB, MySQL, MongoDB, or LibSQL containers. Successful exploitation exposes database contents and credentials, and can enable container escape when the target container is overprivileged.

Critical Impact
Authenticated administrators can execute arbitrary shell commands inside database containers, exposing stored data and credentials, with potential for container escape on overprivileged deployments.

Affected Products

Dokploy versions prior to 0.29.13
Affected files: packages/server/src/utils/backups/utils.ts
Affected files: packages/server/src/utils/restore/utils.ts

Discovery Timeline

2026-08-10 - CVE-2026-72881 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72881

Vulnerability Analysis

The vulnerability resides in Dokploy's database backup and restore command builders. These builders construct shell command strings that are executed through Node.js child_process.exec(). User-controlled database configuration fields such as database name, username, and password are inlined directly into nested shell command strings without escaping or quoting.

Because the outer command wraps an inner shell script inside docker exec ... sh -c "...", the interpolated values pass through two layers of shell parsing. An attacker can supply values containing shell metacharacters, quotes, or command substitutions to break out of the intended command and execute arbitrary commands inside the target database container.

Root Cause

The root cause is unsafe string interpolation of untrusted input into shell commands. The original implementations used template literals to embed identifiers directly in commands such as pg_restore -U '${databaseUser}' -d ${database} and mariadb -u '${databaseUser}' -p'${databasePassword}' ${database}. Single-quote wrapping is insufficient because the attacker controls the value and can close the quote to inject additional shell tokens.

Attack Vector

An authenticated administrator with permission to create databases and configure backups supplies a crafted value in a database configuration field (name, user, or password). When a backup or restore job runs, the malicious value is interpolated into the shell command and executed inside the PostgreSQL, MariaDB, MySQL, MongoDB, or LibSQL container. The attacker gains command execution in the database container context and can read database contents, exfiltrate credentials, or attempt container escape if the container is overprivileged.

typescript

// Security patch from packages/server/src/utils/restore/utils.ts
// Before (vulnerable): user-controlled values interpolated into shell string
// return `docker exec -i $CONTAINER_ID sh -c "pg_restore -U '${databaseUser}' -d ${database} -O --clean --if-exists"`;

// After (patched): values passed via docker exec -e and referenced as "$VAR"
// inside a single-quoted inner script, so they never enter the inner command text.
import { quote } from "shell-quote";

export const getPostgresRestoreCommand = (
	database: string,
	databaseUser: string,
) => {
	return `docker exec -e DB_NAME=${quote([database])} -e DB_USER=${quote([databaseUser])} -i $CONTAINER_ID sh -c 'pg_restore -U "$DB_USER" -d "$DB_NAME" -O --clean --if-exists'`;
};

export const getMariadbRestoreCommand = (
	database: string,
	databaseUser: string,
	databasePassword: string,
) => {
	return `docker exec -e DB_NAME=${quote([database])} -e DB_USER=${quote([databaseUser])} -e DB_PASS=${quote([databasePassword])} -i $CONTAINER_ID sh -c 'mariadb -u "$DB_USER" -p"$DB_PASS" "$DB_NAME"'`;
};

Source: GitHub Commit ccd2e83

Detection Methods for CVE-2026-72881

Indicators of Compromise

Database configuration fields (name, user, password) containing shell metacharacters such as ;, |, &, `, $(, or unescaped single quotes.
Unexpected child processes spawned by database containers during backup or restore jobs, such as sh, curl, wget, or reverse-shell binaries.
Outbound network connections initiated by PostgreSQL, MariaDB, MySQL, MongoDB, or LibSQL container processes to unfamiliar destinations.
Modifications to backup or restore scheduling entries followed shortly by anomalous execution in the associated container.

Detection Strategies

Review Dokploy audit logs for database create and backup-configuration events, correlating administrator identity with suspicious field values.
Inspect container runtime logs (docker logs, containerd events) for docker exec invocations whose command line includes unexpected shell metacharacters.
Deploy runtime monitoring on database containers to flag process executions outside the expected database binary set.

Monitoring Recommendations

Alert on any process execution inside database containers that is not the primary database daemon or an expected backup client (pg_dump, mysqldump, mongodump).
Monitor for outbound network traffic from database containers to non-database destinations.
Track Dokploy administrator account activity, especially changes to database or backup configurations outside change-management windows.

How to Mitigate CVE-2026-72881

Immediate Actions Required

Upgrade Dokploy to version 0.29.13 or later, which passes identifiers through docker exec -e environment variables and references them as "$VAR" inside a single-quoted inner script.
Audit existing database and backup configurations for entries containing shell metacharacters and remove or recreate suspicious entries.
Rotate credentials for any databases whose configuration may have been tampered with by an administrator account.
Review Dokploy administrator accounts and reduce the number of users holding database and backup configuration privileges.

Patch Information

The issue is fixed in Dokploy 0.29.13. The patch imports shell-quote and wraps user-controlled identifiers with quote() before passing them as docker exec -e environment variables. The inner shell script references the values as "$DB_NAME", "$DB_USER", and "$DB_PASS" so they are never interpolated into the command text. See the GitHub Security Advisory GHSA-qc73-mp78-4833, the pull request, and the v0.29.13 release notes.

Workarounds

Restrict Dokploy administrator access to trusted operators until the upgrade to 0.29.13 is completed.
Run database containers with least privilege: drop unnecessary Linux capabilities, avoid --privileged, and mount only required volumes to limit container-escape impact.
Temporarily disable scheduled backup and restore jobs on affected instances until the patched version is deployed.

bash

# Upgrade Dokploy to the patched release
docker pull dokploy/dokploy:0.29.13

# Verify the running version after upgrade
docker exec dokploy dokploy --version

# Harden database container runtime (example for docker run)
docker run \
  --cap-drop=ALL \
  --security-opt no-new-privileges \
  --read-only \
  postgres:16