CVE-2026-72879 Dokploy CVE debrief

Who should care

Administrators and users of Dokploy servers, especially those with project access, should assess exposure and prioritize updating to version 0.29.8 or later. Security teams and platform operators managing Dokploy instances should review potential impacts, including command execution risks, and implement compensating controls if immediate updates are not feasible.

Why it matters

CVE-2026-72879 is a critical command injection vulnerability in Dokploy that allows authenticated users with project access to execute arbitrary OS commands on the server. This issue requires immediate attention to prevent potential exploitation.

• Potential execution of arbitrary OS commands on the Dokploy server
• Possible read or modification of host files
• Access to other containers through Docker

Technical summary

The getRegistryCommands() function in Dokploy packages/server/src/utils/cluster/upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. This allows an authenticated user with project access to execute arbitrary OS commands on the Dokploy server, potentially leading to command execution, file modification, and container access. The issue is addressed in version 0.29.8 with proper input validation and escaping of registry credentials in shell commands. Dokploy server administrators should prioritize updating to the patched version.

Defensive priority

High

Recommended defensive actions

• Review and update Dokploy installations to version 0.29.8 or later
• Restrict access to sensitive configuration and authentication settings
• Monitor Dokploy server logs for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. The Dokploy server, prior to version 0.29.8, is affected by a command injection vulnerability. Evidence is based on CVE and NVD documentation, with limitations on source-provided details. Defensive verification tasks include reviewing Dokploy server logs for suspicious activity and validating user access controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.