PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45633 Dokploy CVE debrief

Dokploy versions 0.26.6 and earlier contain a critical command injection vulnerability in the /docker-container-logs WebSocket endpoint. The tail and since parameters are not validated and are directly concatenated into shell commands, allowing authenticated users to execute arbitrary commands with root privileges. This vulnerability has a CVSS 3.1 score of 9.9 (Critical). The issue was published on May 29, 2026, and modified later the same day. The vulnerability is classified as CWE-78 (OS Command Injection). No known exploitation in ransomware campaigns has been reported, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Dokploy
Product
Unknown
CVSS
CRITICAL 9.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-07-22
Advisory published
2026-05-29
Advisory updated
2026-07-22

Who should care

Organizations running Dokploy 0.26.6 or earlier for application deployment and container management should prioritize patching. Security teams managing self-hosted PaaS infrastructure and DevOps engineers responsible for container orchestration platforms are particularly affected.

Technical summary

The /docker-container-logs WebSocket endpoint in Dokploy 0.26.6 and earlier fails to validate the tail and since parameters, allowing direct concatenation into shell commands. Authenticated attackers can inject arbitrary commands that execute with root privileges, resulting in complete system compromise.

Defensive priority

Critical

Recommended defensive actions

  • Upgrade Dokploy to a version newer than 0.26.6 as soon as a patched version is available
  • Review and restrict access to the /docker-container-logs WebSocket endpoint to only trusted authenticated users
  • Implement input validation and sanitization for the tail and since parameters before processing
  • Consider network segmentation to limit exposure of Dokploy management interfaces
  • Monitor for suspicious command execution activity in container environments
  • Review audit logs for unauthorized access attempts to the affected endpoint

Evidence notes

The vulnerability affects Dokploy 0.26.6 and earlier. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H indicates network attack vector, low attack complexity, low privileges required, no user interaction, changed scope, and high impact on confidentiality, integrity, and availability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45633 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45633

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45633 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45633

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.