CVE-2026-72740 Dokploy CVE debrief

Who should care

Defenders responsible for Dokploy deployments, security teams, and administrators of Dokploy instances should assess exposure and prioritize remediation. This includes reviewing deployment configurations, verifying Dokploy version, and monitoring for suspicious activities. Operators and platform administrators should also be aware of the potential impact and take necessary actions to secure their environments.

Why it matters

CVE-2026-72740 is a critical vulnerability in Dokploy that allows authenticated members with deployment permissions to execute arbitrary commands on the host. Defenders should prioritize verification, upgrading to version 0.29.13 or later, restricting permissions, and monitoring activities.

• Potential for arbitrary command execution on Dokploy hosts
• Risk of unauthorized access and malicious activities
• Need for verification of Dokploy version and deployment configurations
• Importance of restricting deployment permissions and monitoring activities

Technical summary

The vulnerability in Dokploy arises from improper sanitization of user-controlled customGitUrl in packages/server/src/utils/providers/git.ts, allowing an authenticated member with service deployment permission and an attached SSH key to execute arbitrary commands on the Dokploy host during deployment. This issue is fixed in version 0.29.13. The vulnerability has a CVSS score of 9.9 and is considered critical. Dokploy is a free, self-hostable Platform as a Service (PaaS). The affected component is packages/server/src/utils/providers/git.ts.

Defensive priority

Defenders should prioritize verifying and upgrading to Dokploy version 0.29.13 or later, restricting deployment permissions, and monitoring for suspicious deployment activities.

Recommended defensive actions

• Verify and upgrade to Dokploy version 0.29.13 or later
• Restrict deployment permissions to minimize exposure
• Monitor for suspicious deployment activities
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. However, additional information on potential exploitation or affected systems is limited. Defenders should verify Dokploy version, review deployment configurations, and monitor for suspicious activities. Evidence from the CVE Program and NVD suggests a critical vulnerability allowing arbitrary command execution. Limited information is available on affected systems or potential exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.