External risk intelligence

Dokploy Command Injection via Unquoted Shell Interpolation

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-72736

Dokploy is a self-hostable Platform as a Service (PaaS) designed to manage applications, clusters, and deployments. As a centralized management platform for infrastructure and container orchestration, it is commonly deployed as a web-based administrative interface accessible over the network to facilitate remote management of services.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Dokploy, a self-hosted Platform as a Service. This issue allows for the execution of arbitrary commands by exploiting how user-provided information is handled in specific administrative functions. Given Dokploy's role in managing applications and clusters, confirming its presence and exposure is a key concern.

User input runs dangerous commands remotely.
Affects infrastructure management, impacting operations.
Confirm relevance and exposure for security posture.

Attack Path

How an attacker could exploit the issue

An attacker with low privileges could exploit this vulnerability by sending specially crafted input to Dokploy's remote management endpoints. If these inputs are passed directly into shell commands without proper sanitization, an attacker could execute arbitrary code on the server. This could allow them to take control of the system, steal sensitive data, or disrupt services.

Requires authenticated access.
User input in remote endpoints.
Full system compromise possible.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow an authenticated attacker to execute arbitrary commands on the server through specific API endpoints. This could affect the integrity and availability of the Dokploy service and the underlying infrastructure it manages.

Server-side command execution.
Via registry or cluster management endpoints.
Compromise of deployed applications.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this critical vulnerability in Dokploy, application owners and platform teams are likely responsible for remediation. The immediate first step is to identify all Dokploy instances, confirm their exposure and business criticality, and then coordinate a phased update.

Identify Dokploy instances and owners.
Verify remote code execution exposure.
Plan and execute updates during maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dokploy?

Dokploy is an open-source, self-hosted Platform as a Service (PaaS) that simplifies managing containerized applications and infrastructure. It provides a web-based dashboard to handle Docker Swarm clusters and service deployments, acting as a central control plane for developers to automate and oversee their hosted software environments.

What does CVE-2026-72736 mean for my system?

This CVE represents a command injection vulnerability, classified as CWE-77 (Improper Neutralization of Special Elements used in an OS Command). It means that when the software processes certain inputs for registry or cluster management, it fails to sanitize user-provided data, allowing an attacker to inject and execute their own malicious shell commands on the underlying server.

How can an attacker trigger this vulnerability?

An attacker triggers this by submitting specially crafted input to specific Dokploy remote management endpoints. The vulnerability specifically affects the remote execution path; operations handled locally by the system using secure methods like the Docker API or execFileAsync are not susceptible to this command injection risk.

Is my Dokploy instance at risk?

If your instance is accessible over a network, you should be concerned. According to Halo Surface Signal, Dokploy is typically deployed as a web-based administrative interface to facilitate remote management, meaning it is often network-facing. If your instance is reachable by authenticated users over the network, it faces a higher potential for exploitation.

What should I do to secure my environment?

The primary response is to update your Dokploy installation to version 0.29.13 or later, which resolves the unquoted template literal interpolation issue. Before applying the update, inventory your Dokploy instances to identify which ones are active and confirm the necessary maintenance window to perform the upgrade across your infrastructure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.