External risk intelligence

Dokploy Container Root Shell Access Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-72864

Dokploy is a self-hostable Platform as a Service (PaaS) designed to manage deployments and containers. By nature, such management platforms are typically deployed as web-accessible interfaces or API services to allow remote administration, making the surface commonly exposed to the network.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Dokploy, a self-hostable Platform as a Service, allows authenticated users to gain root-level access to arbitrary containers on a self-hosted instance. This could lead to a significant compromise of deployed applications and services within the affected environment. The issue has been addressed in version 0.29.13.

Unrestricted container access for authenticated users.
Compromise of hosted applications and services.
Confirm relevance and exposure of self-hosted instances.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access to a self-hosted Dokploy instance can escalate their privileges to gain a root shell in any container. This is possible because the system fails to properly verify that a user is authorized to access a specific container before executing commands within it. The vulnerability lies in how the `docker-container-terminal` feature handles requests, allowing any authenticated user to interact with arbitrary containers.

Authenticated access to Dokploy is required.
An attacker triggers the terminal feature.
Risk of arbitrary container root shell.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow any authenticated user on a self-hosted Dokploy instance to execute arbitrary commands with root privileges within any container managed by the platform. This is possible because the system does not adequately verify a user's permissions before executing commands within a container, effectively granting broad access when the relevant code path is triggered.

Root shell access in containers.
Unauthenticated user executes `docker exec`.
Complete system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this critical vulnerability in self-hosted Dokploy instances. The immediate first step is to identify all Dokploy deployments, assess their network accessibility and business criticality, and confirm the accountable owner for each. Remediation planning should then be prioritized based on this risk assessment, which may involve coordinating with vendors or implementing temporary risk reduction measures.

Application owners should take primary responsibility.
Verify instance reachability and business criticality.
Plan remediation based on risk and maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dokploy?

Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies managing and deploying applications and containers. It acts as an orchestration layer, providing a web interface or API for users to control their infrastructure, services, and containerized environments from a centralized dashboard.

What does CVE-2026-72864 mean?

This vulnerability is a Missing Authorization flaw, classified as CWE-862. It means the software performs an action—in this case, opening a root-level terminal into a container—without verifying if the currently logged-in user actually has permission to access that specific container.

How can an attacker trigger this vulnerability?

An attacker needs an active, authenticated account on the Dokploy instance to trigger the bug. It is not triggered by simply viewing the interface; the attacker must specifically interact with the container terminal feature. Users who are not logged into the platform cannot reach the vulnerable code path.

Why should I care about this Dokploy flaw?

According to Halo Surface Signal, Dokploy is designed for remote administration, meaning these instances are often intentionally exposed to the network. If your instance is internet-facing, any compromised or malicious authenticated account can potentially gain root control over your entire container ecosystem.

How do I fix CVE-2026-72864?

The primary response is to update your self-hosted Dokploy instance to version 0.29.13 or later. Before updating, identify all your active deployments, confirm who is responsible for them, and prioritize patching those that are accessible over the network to limit potential impact.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.