External risk intelligence

Dokploy OS Command Injection Vulnerability in traefikConfig Endpoint

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-45630

Dokploy is a self-hosted Platform as a Service (PaaS) designed to manage deployments and infrastructure. As a centralized management platform for applications and services, it is commonly deployed as an internet-facing or edge-reachable administrative service, making its management interface a likely target for remote access.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in Dokploy, a self-hosted platform for managing applications and services. The issue allows authenticated administrators to execute arbitrary system commands on the server, potentially impacting the confidentiality, integrity, and availability of the underlying infrastructure. The main concern is confirming relevance and exposure of this self-hosted service within your environment.

Admin users can run unauthorized commands.
It affects self-hosted infrastructure management.
Verify if Dokploy is used in your environment.

Attack Path

How an attacker could exploit the issue

An attacker with administrative or owner privileges in Dokploy could exploit a vulnerability in the `application.updateTraefikConfig` tRPC endpoint. This vulnerability allows for the injection of operating system commands by leveraging unsanitized `echo` shell interpolation. By sending a specially crafted request to this endpoint, an attacker can achieve the execution of arbitrary system commands on the server hosting Dokploy.

Attacker needs admin/owner access.
Triggered via `application.updateTraefikConfig` endpoint.
Allows arbitrary system command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow authenticated administrative users to execute arbitrary commands on the server hosting Dokploy. This could affect the integrity and availability of the Dokploy service and any applications it manages.

System commands on the server could be executed.
Via an authenticated API endpoint.
Compromise of the Dokploy service and managed applications.

Operational Fix

Recommended remediation, mitigation, and detection steps

Platform owners and infrastructure teams are most likely responsible for addressing this critical vulnerability in Dokploy, as it allows authenticated users to execute arbitrary system commands. The first practical step involves identifying all Dokploy instances, confirming their reachability and business criticality, and then assigning an owner for remediation planning.

Platform or infrastructure teams own resolution.
Verify affected instances and reachability.
Plan remediation with accountable owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dokploy?

Dokploy is an open-source, self-hosted Platform as a Service (PaaS). It functions as a centralized management hub that simplifies how users deploy, monitor, and scale applications and infrastructure. Because it acts as an orchestration layer, it is often installed on servers intended to manage multiple backend services.

What is the vulnerability in CVE-2026-45630?

This vulnerability is an OS command injection, classified as CWE-78. It means an attacker can force the host server to execute unauthorized system commands. In this specific case, the software fails to properly clean input before passing it to a shell environment, allowing a user to break out of the intended application logic and run arbitrary code on the underlying operating system.

How is this Dokploy vulnerability triggered?

An attacker must have existing authenticated access with administrative or owner privileges to trigger this issue. The vulnerability exists within the application.updateTraefikConfig tRPC endpoint. Requests that do not use this specific endpoint or come from users without these elevated privileges will not trigger the command injection.

Is my Dokploy instance at risk?

If you run Dokploy, you should evaluate your risk based on its placement. According to Halo Surface Signal, because Dokploy is a management platform, it is frequently configured as an internet-facing or edge-reachable service. If your instance is accessible from the internet rather than restricted to a private internal network, the potential for remote exploitation is significantly higher.

What should I do to address CVE-2026-45630?

Start by identifying all Dokploy instances currently active in your infrastructure to determine which are critical to your operations. Once you have a complete inventory, verify the network reachability of these instances. Assign clear ownership to your infrastructure or platform teams to manage the remediation process and minimize potential impact on your systems.

References

github.com/Dokploy/dokploy/security/advisories/GHSA-p787-6gqg-cvp5

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.