External risk intelligence

Dokploy OS Command Injection Affects Organizations

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-45629

Dokploy is a self-hostable Platform as a Service (PaaS) designed to manage remote servers and deployments. Such platforms are typically deployed as internet-facing management interfaces or portals to provide centralized access for managing infrastructure and application delivery.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Dokploy, a self-hostable Platform as a Service, has a vulnerability in versions earlier than 0.28.8. This flaw allows authenticated users to inject operating system commands, leading to the execution of arbitrary commands on remote servers managed by the platform. The potential impact includes a complete compromise of these servers.

Vulnerable component: Dokploy WebSocket endpoint
Core weakness: OS command injection
Main business impact: Full server compromise

Attack Path

How an attacker could exploit the issue

An authenticated command injection vulnerability exists in Dokploy, a self-hostable PaaS. This flaw allows any organization member to run unauthorized commands on remote servers managed by Dokploy. Successful exploitation leads to the compromise of these servers.

Exposure: Internet-facing
Attacker access: Authenticated user
Trigger: WebSocket endpoint
Impact: Full server compromise

Live Threat

Current exploitation, exposure, and threat context

An authenticated command injection vulnerability in Dokploy could allow an organization member to execute arbitrary system commands on remote servers. This could lead to a full server compromise. The impact on affected organizations includes potential data breaches, system disruption, and unauthorized access to sensitive information.

Likely attacker skill: Moderate
Required access: Authenticated organization member
Business risk: High

Operational Fix

Recommended remediation, mitigation, and detection steps

An authenticated operating system command injection vulnerability exists in Dokploy versions prior to 0.28.8. This flaw allows any organization member to execute arbitrary system commands on remote servers managed by Dokploy, potentially leading to a full server compromise. The issue is present in the /listen-deployment WebSocket endpoint.

Find exposed Dokploy assets.
Reduce exposure or isolate affected systems.
Apply vendor fix, verify, and monitor.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dokploy and what is its primary function?

Dokploy is a free, self-hostable Platform as a Service (PaaS) used for managing remote servers and application deployments, offering a centralized method for handling infrastructure and delivery.

What is the critical weakness in Dokploy related to CVE-2026-45629?

The vulnerability, classified as CWE-78 (OS command injection), permits an authenticated user to insert and execute arbitrary operating system commands on servers managed by Dokploy, potentially resulting in a complete compromise of those servers.

How is the Dokploy vulnerability exploited?

The flaw is triggered through the /listen-deployment WebSocket endpoint, allowing any member within an organization to inject and execute commands on remote servers managed by Dokploy.

What is the relevance of the Dokploy vulnerability?

Dokploy, a self-hostable PaaS for managing servers, has a critical command injection flaw. This vulnerability enables authenticated users to execute arbitrary commands on remote servers, leading to their full compromise and potential data breaches or system disruption.

What steps should be taken to address the Dokploy vulnerability?

Organizations should identify exposed Dokploy assets, reduce their exposure or isolate affected systems, apply the vendor's fix to versions 0.28.8 and later, verify the fix, and implement ongoing monitoring for any suspicious activity.

References

github.com/Dokploy/dokploy/security/advisories/GHSA-r73h-qr3p-hf7f

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.