Skip to content
Dokploy vulnerabilities
Newest
-
dokploy
Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router
CVE-2026-116068
8.7 High
-
dokploy
Dokploy through 0.30.8 Cross-Organization Authorization Bypass via port tRPC Router
CVE-2026-111331
5.3 Medium
-
dokploy
Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root
CVE-2026-93425
9.9 Critical
-
dokploy
Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one
CVE-2026-86059
9.6 Critical
-
dokploy
Dokploy Settings application.ts writeTraefikConfigInPath path traversal
CVE-2026-82954
9.4 Critical
-
dokploy
Dokploy: Password Change Does Not Revoke Active Sessions
CVE-2026-45791
5.9 Medium
-
dokploy
Dokploy: Invitation Role Escalation Allows Organization Takeover
CVE-2026-45790
8.0 High
-
dokploy
Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryById
CVE-2026-72902
9.9 Critical
-
dokploy
Dokploy: Remote Code Execution via volume-backup
CVE-2026-72901
9.9 Critical
-
dokploy
Dokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of CVE-2026-45632)
CVE-2026-72886
9.9 Critical
-
dokploy
Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builder
CVE-2026-72885
0.0 None
-
dokploy
Dokploy: Command Injection via Compose Custom Command
CVE-2026-72884
8.7 High
-
dokploy
Dokploy: WebSocket Terminal Missing Service-Level Access Control
CVE-2026-72883
8.8 High
-
dokploy
Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers
CVE-2026-72882
9.9 Critical
-
dokploy
Dokploy: Command Injection via database credentials in backup/restore commands
CVE-2026-72881
6.4 Medium
-
dokploy
Dokploy: Arbitrary File Write + Remote OS Command Injection via `certificatePath`
CVE-2026-72880
9.9 Critical
-
dokploy
Dokploy: Command Injection via Registry Credentials in Swarm Upload
CVE-2026-72879
9.4 Critical
-
dokploy
Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell arguments
CVE-2026-72878
9.6 Critical
-
dokploy
Dokploy: Command Injection via dockerImage in buildRemoteDocker
CVE-2026-72877
9.6 Critical
-
dokploy
Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.*
CVE-2026-72876
9.9 Critical
-
dokploy
Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFile
CVE-2026-72875
8.8 High
-
dokploy
Dokploy: Command Injection via Unescaped Git URL in Clone Commands
CVE-2026-72874
8.7 High
-
dokploy
Dokploy: Cross-tenant Git provider secrets are disclosed to low-privileged service readers via `application.one`
CVE-2026-72873
6.5 Medium
-
dokploy
Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone`
CVE-2026-72872
9.9 Critical
-
dokploy
Dokploy: Unauthenticated Git Provider Injection via GitHub OAuth Callback
CVE-2026-72871
7.5 High
-
dokploy
Dokploy: Command Injection via Docker Credentials in buildRemoteDocker
CVE-2026-72870
8.7 High
-
dokploy
Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE
CVE-2026-72869
9.9 Critical
-
dokploy
Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection
CVE-2026-72868
9.9 Critical
-
dokploy
Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts)
CVE-2026-72867
Public exploit
9.9 Critical
-
dokploy
WebSocket Terminal Auth Bypass
CVE-2026-72866
8.8 High
-
dokploy
Dokploy: OS Command Injection via compose `composePath`
CVE-2026-72865
9.9 Critical
-
dokploy
Dokploy Broken Access Control on docker-container-terminal WebSocket (Member -> Root in Arbitrary Containers)
CVE-2026-72864
9.9 Critical
-
dokploy
Dokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker host
CVE-2026-72863
9.9 Critical
-
dokploy
Dokploy: OS Command Injection via dockerImage field in database service deployment functions → HOST RCE
CVE-2026-72862
9.9 Critical
-
dokploy
Dokploy: OS Command Injection via SSH-form `customGitUrl` domain in `ssh-keyscan`
CVE-2026-72740
9.9 Critical
-
dokploy
Dokploy: Command Injection via Compose Shell Execution
CVE-2026-72739
6.5 Medium
-
dokploy
Dokploy: Authenticated RCE via Command Injection in backup.listBackupFiles search Parameter
CVE-2026-72738
9.9 Critical
-
dokploy
Dokploy: Cross-organization IDOR in Dokploy backup destinations exposes another tenant's S3 credentials and backups
CVE-2026-72737
9.6 Critical
-
dokploy
Dokploy: OS Command Injection in registry credential testing and Swarm cluster management → HOST RCE
CVE-2026-72736
9.9 Critical
-
dokploy
Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescaped YAML in SSH remote execution
CVE-2026-72735
9.9 Critical
-
dokploy
Dokploy: Cross-organization authorization bypass in server.remove allows deletion of another organization's server registration
CVE-2026-72734
8.4 High
-
dokploy
Dokploy: OS Command Injection via `databaseName` / `backupFile` in database restore
CVE-2026-72733
9.9 Critical
-
dokploy
Dokploy: Authenticated Remote Code Execution via Command Injection in /listen-deployment WebSocket Endpoint
CVE-2026-45629
9.9 Critical
-
dokploy
Dokploy: Cross-Organization IDOR - Multiple tRPC endpoints missing activeOrganizationId validation
CVE-2026-43917
5.3 Medium
-
dokploy
Dokploy: Command Injection via Unescaped Branch Fields in Deployment Pipeline
CVE-2026-45628
9.6 Critical
-
dokploy
Dokploy: Authenticated Remote Code Execution via Command Injection in updateTraefikConfig Echo Statement
CVE-2026-45630
9.0 Critical
-
dokploy
Dokploy: Pre-Auth Admin Takeover via Hardcoded Authentication Secret
CVE-2026-45631
10.0 Critical
-
dokploy
Dokploy: Schedule Authorization Bypass Enables Host/Server Command Execution
CVE-2026-45632
9.9 Critical
-
dokploy
Dokploy: Command Injection in /docker-container-logs Endpoint
CVE-2026-45633
9.9 Critical
-
dokploy
Dokploy: Remote Code Execution through Path Traversal
CVE-2026-45661
9.9 Critical
- Show olderLoading…