External risk intelligence

Dokploy Command Injection Vulnerability in Docker Container Logs Endpoint

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-45633

Dokploy is a self-hostable Platform as a Service (PaaS) designed to manage deployments and applications. Such platforms act as gateways or management interfaces and are commonly exposed to the internet or accessible via remote management surfaces to facilitate application deployment and monitoring in typical real-world deployments.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability found in Dokploy, a self-hostable Platform as a Service. The issue allows authenticated users to run unauthorized commands with full system privileges by exploiting an unvalidated input in the Docker container logs feature. This could potentially lead to a compromise of the entire platform and any applications it manages.

An authenticated user can gain root access.
Affects self-hosted application deployment platforms.
Confirm relevance and exposure of this PaaS.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access to Dokploy can exploit a command injection vulnerability in the Docker container logs feature. By manipulating the `tail` and `since` parameters in requests to the `/docker-container-logs` WebSocket endpoint, an attacker can inject and execute arbitrary commands on the server with root privileges. This could allow them to compromise the entire Dokploy instance and any applications it manages.

Authenticated access to Dokploy is required.
Injecting commands via WebSocket parameters.
Execute arbitrary code as root.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow authenticated users to run arbitrary commands on the server with root privileges, potentially impacting the Dokploy PaaS and any applications it manages. The vulnerability exists in the handling of parameters within the /docker-container-logs WebSocket endpoint when these parameters are directly used in shell commands without proper validation.

Server-side commands and system data.
Authenticated users could inject commands.
Full server compromise and data loss.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Dokploy affects self-hostable PaaS deployments, likely managed by platform or infrastructure teams. The first practical step is to identify all Dokploy instances, assess their reachability and criticality, and determine the accountable owner before planning remediation.

Platform or infrastructure teams own this.
Verify Dokploy instance reachability.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dokploy?

Dokploy is a free, self-hosted Platform as a Service (PaaS). It functions as a management interface that simplifies deploying, monitoring, and organizing applications. Because it manages infrastructure, it is often installed on servers to act as a centralized hub for application environments.

What does CVE-2026-45633 mean for Dokploy users?

This vulnerability is a command injection flaw, identified as CWE-78. It occurs when a program takes user-supplied input and incorporates it into a system command without cleaning it first. In this case, the flaw allows someone who has already authenticated to Dokploy to trick the system into running their own malicious commands, granting them root-level control over the underlying server.

How can an attacker trigger this vulnerability?

The issue is triggered by sending a specifically crafted request to the /docker-container-logs WebSocket endpoint. An attacker manipulates the 'tail' or 'since' parameters to insert unauthorized commands. This will not trigger if the input is only used for legitimate log viewing, nor can an unauthenticated user trigger the bug; the attacker must have a valid account on the Dokploy instance.

Is my Dokploy instance at risk?

Halo Surface Signal indicates that Dokploy is often deployed in ways that are accessible over the internet to support remote application management, which increases the likelihood that it is reachable by external parties. If your instance is accessible beyond an internal-only network or shared with multiple users, the risk of an authenticated account being compromised and used to execute this attack is significantly higher.

What should I do if I use Dokploy?

First, perform an inventory to locate all instances of Dokploy currently running in your environment. Evaluate who has access to these platforms, as this vulnerability relies on an authenticated session. Once the instances are identified and accountable owners are assigned, prioritize them based on how they are exposed to your network and plan for the necessary updates or security configurations to mitigate the risk.

References

github.com/Dokploy/dokploy/security/advisories/GHSA-wmqj-wr9q-327p

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.