External risk intelligence

Dokploy Command Injection in Database Deployment Functions

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-72862

Dokploy is a self-hostable Platform as a Service (PaaS) designed to manage application and database deployments. As a central management platform, it is commonly deployed as an internet-facing administrative web interface to facilitate remote control of infrastructure and services, making its management surface frequently accessible from the internet.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Dokploy, a self-hostable Platform as a Service, that could allow unauthorized access and control of deployed applications and databases. The issue stems from how user-provided information is handled in commands that deploy database services, potentially leading to significant compromise if exploited. The primary concern is confirming the relevance and exposure of this specific technology within your environment.

Unquoted user input in database deployment commands.
Impacts any organization using this PaaS for deployments.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with low privileges could send a specially crafted request to Dokploy's database deployment functions. This request would allow them to execute arbitrary commands on the server hosting Dokploy, potentially leading to a complete compromise of the system and its data.

Requires authenticated access.
User-controlled input in deployment commands.
Remote code execution and data compromise.

Live Threat

Current exploitation, exposure, and threat context

The vulnerability in Dokploy's database service deployment functions could allow an authenticated attacker to execute arbitrary commands on the remote server. This occurs when unquoted user-controlled values are passed into shell commands used for pulling Docker images. When supported by the advisory, this could impact the integrity and availability of the server and its deployed services.

Remote server command execution.
User-supplied docker image name.
Compromise of server and services.

Operational Fix

Recommended remediation, mitigation, and detection steps

Platform owners or infrastructure teams managing Dokploy instances are primarily responsible for addressing this critical vulnerability. The immediate first step is to identify all Dokploy deployments, assess their internet reachability and business criticality, and pinpoint the accountable owner for each instance. Remediation planning should then be risk-based, considering the exposure and impact.

Platform/Infrastructure teams own the issue.
Verify Dokploy instance reachability and criticality.
Plan remediation considering business impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dokploy?

Dokploy is an open-source, self-hosted Platform as a Service (PaaS). Developers use it to simplify the management, deployment, and scaling of applications and databases by providing a centralized interface to handle infrastructure operations, including the orchestration of Docker containers.

What does CVE-2026-72862 mean?

This CVE identifies a command injection vulnerability (CWE-78). It happens because the software improperly handles user-provided data when setting up database services. By failing to wrap inputs in quotes, the application accidentally allows extra commands to be injected into the underlying system instructions used to pull container images.

How does an attacker trigger this vulnerability?

An attacker triggers this by submitting a specially crafted input for the Docker image name during the database deployment process. Simply browsing the application or sending random requests does not trigger the bug; the attacker must have authenticated access and be able to interact with the specific deployment functions where these shell commands are constructed.

Is my Dokploy instance at risk?

If you run Dokploy, you should check your exposure. According to Halo Surface Signal, Dokploy is often used as an internet-facing administrative interface to manage remote infrastructure. Because the interface is frequently exposed to the network to facilitate management, instances reachable from the internet are at a higher level of concern.

How do I fix this security issue?

The primary action is to update your Dokploy installation to version 0.29.13 or later, which resolves the unquoted input flaw. Before applying the update, identify all your active instances and determine their network accessibility to prioritize patching based on which systems are most critical or exposed.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.