CVE-2026-72877 Dokploy CVE debrief

Who should care

Defenders responsible for Dokploy deployments, administrators with application create or update permissions, and security teams monitoring build hosts and remote SSH build targets should assess exposure and prioritize remediation.

Why it matters

CVE-2026-72877 is a critical vulnerability in Dokploy that allows authenticated users to execute arbitrary commands on build hosts or remote SSH targets. Defenders should prioritize remediation, restrict permissions, and monitor for suspicious activity.

• Potential exposure of host secrets and other projects
• Possible execution of arbitrary commands on local build hosts or remote SSH build targets
• Risk of lateral movement within the environment
• Need for verification of Dokploy version and configuration

Technical summary

The Dokploy PaaS is vulnerable to remote code execution due to improper validation and interpolation of the dockerImage field in buildRemoteDocker(). An authenticated user with application create or update permission can inject shell commands, potentially exposing host secrets and other projects. This vulnerability is a critical issue, with a CVSS score of 9.6, and defenders should prioritize remediation. The vulnerability is fixed in version 0.29.13, and defenders should review and update Dokploy to this version or later. Additionally, defenders should restrict application create and update permissions to trusted users and monitor Dokploy build hosts and remote SSH build targets for suspicious activity.

Defensive priority

High

Recommended defensive actions

• Review and update Dokploy to version 0.29.13 or later
• Restrict application create and update permissions to trusted users
• Monitor Dokploy build hosts and remote SSH build targets for suspicious activity
• Implement additional security controls, such as validating and sanitizing user input
• Conduct a thorough review of Dokploy configurations and environments to identify potential exposure
• Verify Dokploy version and configuration to ensure remediation is effective
• Track and document remediation efforts for future reference and auditing

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Dokploy, a free, self-hostable Platform as a Service (PaaS). An authenticated user with application create or update permission can use shell command substitution in the dockerImage field to execute arbitrary commands on the local build host or a remote SSH build target.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.