CVE-2026-72862 Dokploy CVE debrief

Who should care

Administrators and users of Dokploy, especially those with self-hosted instances, should assess their exposure and update to the patched version. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review the vulnerability's impact on their environments and take necessary actions to prevent exploitation.

Why it matters

CVE-2026-72862 is a critical vulnerability in Dokploy that allows unauthenticated command injection. Defenders should care because it can lead to potential exploitation, data breaches, and system compromise. The vulnerability exists in the database service deployment functions and is fixed in version 0.29.13. Immediate patching or mitigation is necessary to prevent potential attacks.

• Potential for unauthenticated command injection
• Risk of exploitation requires verification from official sources
• Need for immediate patching or mitigation
• Potential impact on data integrity and confidentiality

Technical summary

The Dokploy database service deployment functions are vulnerable to unauthenticated command injection due to improper handling of user-controlled dockerImage fields. This vulnerability exists in mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts and is fixed in version 0.29.13. The vulnerability allows attackers to inject commands, potentially leading to exploitation, data breaches, and system compromise. Immediate patching or mitigation is necessary to prevent potential attacks. Defenders should review and update Dokploy to the patched version, restrict access to affected functions, and monitor for suspicious activity.

Defensive priority

High

Recommended defensive actions

• Review and update Dokploy to version 0.29.13 or later
• Restrict access to the affected database service deployment functions
• Monitor for suspicious activity related to docker pull commands
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Dokploy, a free, self-hostable Platform as a Service (PaaS). The vulnerability exists in the database service deployment functions, specifically in mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts, where user-controlled dockerImage fields are passed unquoted into docker pull ${dockerImage} shell commands.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.