External risk intelligence

Dokploy Remote Command Execution via Traefik Configuration

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-72735

Dokploy is a self-hostable Platform as a Service (PaaS) designed to manage, deploy, and expose web applications and services. By nature, such platforms act as gateways or management interfaces that are commonly deployed to be internet-facing to facilitate remote application deployment and traffic routing.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Dokploy Platform as a Service software, specifically affecting how it handles remote server configurations. This issue allows for the execution of arbitrary commands on managed servers if user-controlled configuration data is improperly processed, potentially leading to a compromise of these systems. The main concern is confirming relevance and exposure.

Arbitrary commands can run on servers.
It allows attackers to control your managed servers.
Confirm if your Dokploy instances are exposed.

Attack Path

How an attacker could exploit the issue

An attacker with low privileges can target Dokploy by submitting specially crafted configuration values. When Dokploy processes these values to generate Traefik configuration, a flaw in how user input is handled can allow an attacker to break out of expected command arguments. This could enable the attacker to execute arbitrary commands on the server hosting Dokploy, with the privileges of the SSH user.

Attacker needs low-privileged access.
User-controlled input terminates shell quoting.
Arbitrary command execution on remote servers.

Live Threat

Current exploitation, exposure, and threat context

When Dokploy is used to manage remote servers, an attacker with authenticated access could potentially execute arbitrary commands on those servers. This could occur when the attacker can influence configuration values, such as domain names or authentication credentials, which are then improperly handled when constructing shell commands. The attacker's commands would run with the privileges of the SSH user configured for the remote server.

Arbitrary commands on remote servers.
User-controlled configuration input.
Compromise of managed remote servers.

Operational Fix

Recommended remediation, mitigation, and detection steps

Ownership of this vulnerability likely falls to the platform or infrastructure teams managing Dokploy deployments. The first practical step is to identify all Dokploy instances, determine their exposure and criticality, locate the accountable owners, and then prioritize remediation.

Platform/Infrastructure teams own the fix.
Verify Dokploy instance reachability and criticality.
Plan remediation based on risk exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dokploy?

Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment, management, and routing of web applications. Developers and infrastructure teams use it to streamline the process of running services on remote servers.

What does CVE-2026-72735 mean for Dokploy?

This vulnerability is classified as CWE-77, or Improper Neutralization of Special Elements used in an OS Command. It means the software fails to properly sanitize user inputs, allowing an attacker to inject and execute their own commands on the underlying operating system.

How does an attacker trigger this command injection?

An attacker triggers this by inputting specific characters—like single quotes—into configuration fields such as domain names, authentication usernames, or redirect rules. Simply using the platform normally without injecting these shell-breaking characters does not trigger the flaw.

Is my Dokploy instance at risk?

Halo Surface Signal indicates that Dokploy is often deployed in internet-facing configurations to manage remote services, which increases the likelihood of exposure. If your instance is accessible over the network, it is a higher priority for review.

What is the first step to address this CVE?

The most effective response is to update your Dokploy installation to version 0.29.13 or later. Prior to updating, teams should identify all managed instances to assess their specific reachability and confirm that the latest version is applied to eliminate the vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.