CVE-2026-72738 Dokploy CVE debrief

Who should care

Dokploy administrators, security teams, and developers responsible for maintaining or securing Dokploy instances should assess exposure and prioritize remediation efforts immediately. This includes reviewing compensating controls, monitoring for suspicious activity, and verifying command execution prevention. Additionally, operators and platform administrators should be aware of the potential for arbitrary command execution on Dokploy hosts and take steps.

Why it matters

CVE-2026-72738 is a critical vulnerability in Dokploy that allows authenticated users to execute arbitrary commands on the host. Dokploy administrators and security teams should assess exposure, prioritize patching to version 0.29.13 or later, and verify command execution prevention. Evidence is limited, and additional information on potential exploitation or impact is unknown.

• Potential for arbitrary command execution on Dokploy hosts
• Possible lateral movement or escalation of privileges
• Need for verification of command execution prevention
• Requirement for patching or mitigating vulnerable Dokploy instances

Technical summary

The backup.listBackupFiles tRPC endpoint in Dokploy passes the search parameter through normalizeS3Path and interpolates it into an rclone lsjson command executed by child_process.exec(). An authenticated user with backup:read permission can exploit this to execute arbitrary commands on the Dokploy host, potentially leading to lateral movement or escalation of privileges. This issue is fixed in version 0.29.13, and immediate remediation is required for Dokploy instances with untrusted user access. Dokploy administrators should assess exposure and prioritize patching efforts.

Defensive priority

Immediate remediation is required for Dokploy instances with untrusted user access. Assess exposure, prioritize patching, and verify command execution prevention.

Recommended defensive actions

• Patch Dokploy to version 0.29.13 or later
• Restrict access to the backup.listBackupFiles tRPC endpoint
• Monitor for suspicious activity on Dokploy hosts
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed version. However, additional information on potential exploitation or impact is limited. Defenders should verify command execution prevention, review compensating controls, and monitor for suspicious activity on Dokploy hosts. The evidence is limited, and further verification is required to understand the full scope of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.