CVE-2026-72739 Dokploy CVE debrief

Who should care

Administrators and users of Dokploy platform, especially those who deploy compose files with custom service names or configurations, should assess exposure and verify if their deployments are vulnerable. Dokploy users should prioritize updating to version 0.29.13 or later.

Why it matters

CVE-2026-72739 is a medium-severity vulnerability in Dokploy that allows for arbitrary command execution on the Docker host. Dokploy administrators and users should assess exposure, verify deployment configurations, and prioritize updating to version 0.29.13 or later to prevent potential exploitation.

• Potential for arbitrary command execution on the Docker host
• Possible lateral movement and exploitation of other services
• Need for verification of Dokploy version and deployment configurations
• Potential for data breaches or unauthorized access

Technical summary

The Dokploy platform has a vulnerability that allows for arbitrary command execution on the Docker host when a compose with a maliciously crafted name or service definition is deployed. The createCommand() function constructs shell commands by interpolating compose service names and configuration into bash command strings, allowing shell metacharacters to be interpreted as command separators. This vulnerability is fixed in version 0.29.13. Dokploy administrators and users should assess exposure, verify deployment configurations, and prioritize updating to version 0.29.13 or later to prevent potential exploitation. The vulnerability can be mitigated by restricting compose service names and configuration to

Defensive priority

Medium

Recommended defensive actions

• Review and update Dokploy to version 0.29.13 or later
• Restrict compose service names and configuration to prevent malicious input
• Monitor Dokploy deployments for suspicious activity
• Confirm whether affected Dokploy deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. The Dokploy platform has a vulnerability that allows for arbitrary command execution on the Docker host when a compose with a maliciously crafted name or service definition is deployed. The vulnerability is fixed in version 0.29.13.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.