PatchSiren cyber security CVE debrief

CVE-2026-45633 Dokploy CVE debrief

Dokploy versions 0.26.6 and earlier contain a critical command injection vulnerability in the /docker-container-logs WebSocket endpoint. The tail and since parameters are not validated and are directly concatenated into shell commands, allowing authenticated users to execute arbitrary commands with root privileges. This vulnerability has a CVSS 3.1 score of 9.9 (Critical). The issue was published on May 29, 2026, and modified later the same day. The vulnerability is classified as CWE-78 (OS Command Injection). No known exploitation in ransomware campaigns has been reported, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor: Dokploy
Product: Unknown
CVSS: CRITICAL 9.9
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-29
Original CVE updated: 2026-05-29
Advisory published: 2026-05-29
Advisory updated: 2026-05-29

Who should care

Organizations running Dokploy 0.26.6 or earlier for application deployment and container management should prioritize patching. Security teams managing self-hosted PaaS infrastructure and DevOps engineers responsible for container orchestration platforms are particularly affected.

Technical summary

The /docker-container-logs WebSocket endpoint in Dokploy 0.26.6 and earlier fails to validate the tail and since parameters, allowing direct concatenation into shell commands. Authenticated attackers can inject arbitrary commands that execute with root privileges, resulting in complete system compromise.

Defensive priority

Critical

Recommended defensive actions

Upgrade Dokploy to a version newer than 0.26.6 as soon as a patched version is available
Review and restrict access to the /docker-container-logs WebSocket endpoint to only trusted authenticated users
Implement input validation and sanitization for the tail and since parameters before processing
Consider network segmentation to limit exposure of Dokploy management interfaces
Monitor for suspicious command execution activity in container environments
Review audit logs for unauthorized access attempts to the affected endpoint

Evidence notes

The vulnerability affects Dokploy 0.26.6 and earlier. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H indicates network attack vector, low attack complexity, low privileges required, no user interaction, changed scope, and high impact on confidentiality, integrity, and availability.

Official resources

The vulnerability was disclosed through GitHub Security Advisories and is tracked as GHSA-wmqj-wr9q-327p.