CVE-2026-72867 Dokploy CVE debrief

Who should care

System administrators and security teams responsible for Dokploy deployments should assess their exposure and prioritize remediation. This vulnerability requires attention from roles managing PaaS environments, especially those with low-privileged authenticated users.

Why it matters

CVE-2026-72867 is a critical vulnerability in Dokploy that allows low-privileged authenticated users to execute arbitrary host commands. System administrators and security teams managing Dokploy deployments should assess their exposure and prioritize remediation to prevent potential exploitation and lateral movement within the PaaS environment.

• Potential for arbitrary host command execution by low-privileged authenticated users
• Risk of lateral movement and exploitation within the PaaS environment
• Need for verification of Dokploy version and exposure to vulnerable configurations
• Priority for updating to version 0.29.13 or later to mitigate the vulnerability

Technical summary

CVE-2026-72867 is a critical vulnerability in Dokploy, a free, self-hostable Platform as a Service (PaaS). The issue arises from an incomplete fix for CVE-2026-45628, allowing a low-privileged authenticated user to store a malicious custom Git branch. When the user triggers a deployment, the stored branch is passed to shell-based Git clone commands, resulting in arbitrary host command execution. The vulnerability is fixed in version 0.29.13. Dokploy deployments should be reviewed and updated to prevent potential exploitation. The CVE record and NVD entry provide details on the vulnerability, including affected versions and fixed releases.

Defensive priority

High

Recommended defensive actions

• Review and update Dokploy to version 0.29.13 or later
• Restrict access to authenticated users with low privileges
• Monitor for suspicious activity related to Git branch updates and deployments
• Perform regular security audits and vulnerability assessments
• Implement additional logging and monitoring for Git-related activities
• Verify Dokploy version and exposure to vulnerable configurations
• Track and manage changes to Dokploy deployments and configurations

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Dokploy, a free, self-hostable Platform as a Service (PaaS). The issue arises from an incomplete fix for CVE-2026-45628, allowing a low-privileged authenticated user to execute arbitrary host commands via a malicious custom Git branch.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.