CVE-2026-72864 Dokploy CVE debrief

Who should care

System administrators and DevOps teams managing Dokploy instances should assess their exposure and apply the necessary patches. Authenticated users with access to the vulnerable endpoint should be aware of the potential for privilege escalation.

Why it matters

CVE-2026-72864 is a critical vulnerability in Dokploy that allows authenticated users to obtain a root shell in arbitrary containers. Immediate attention is required to patch vulnerable instances and restrict access to the affected endpoint.

• Potential for authenticated users to escalate privileges to root in arbitrary containers.
• Possible lateral movement within the container environment.
• Need for immediate patching to prevent exploitation.
• Requirement for verifying user access controls and monitoring container execution logs.

Technical summary

The vulnerability exists in the /docker-container-terminal endpoint of Dokploy, where the validateRequest function is used for authentication but not for authorization of the containerId parameter. This allows any authenticated member to execute commands in arbitrary containers, effectively granting them a root shell in those containers. The issue arises from inadequate authorization, enabling potential lateral movement within the container environment and privilege escalation. Immediate attention is required to patch vulnerable instances and restrict access to the affected endpoint.

Defensive priority

Immediate attention is required for Dokploy instances. Authenticated users with access to the vulnerable endpoint should be considered potentially able to escalate their privileges. System administrators and DevOps teams should verify their current version and apply the patch in version 0.29.13 if necessary.

Recommended defensive actions

• Verify the current version of Dokploy and apply the patch in version 0.29.13 if necessary.
• Restrict access to the /docker-container-terminal endpoint to only trusted users and services.
• Monitor for any suspicious activity related to container execution and authentication.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its critical CVSS score of 9.9 and the affected versions of Dokploy. The issue is fixed in version 0.29.13, according to the source references provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.