External risk intelligence

Dokploy Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-72876

Dokploy is a self-hostable Platform as a Service (PaaS) designed to manage deployments and applications. As a management platform for infrastructure and web services, it is commonly deployed as an internet-facing or network-accessible administrative interface, making its API endpoints reachable in typical deployment scenarios.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in Dokploy, a self-hosted Platform as a Service. The issue allows unauthorized command execution on other tenants' servers if an attacker has read permissions, potentially impacting the integrity and availability of hosted services. The main concern is confirming relevance and exposure.

Unauthorized server command execution is possible.
Affects multi-tenant PaaS deployment integrity.
Confirm if this self-hosted service is in use.

Attack Path

How an attacker could exploit the issue

An attacker with read permissions can exploit this vulnerability by making unauthorized API calls to specific Dokploy endpoints. By manipulating requests to access information from another organization's server, the attacker can trick the system into executing arbitrary commands on a tenant's server. This could lead to complete compromise of the affected server and its data.

Requires server:read permission.
Invokes API endpoints with malformed requests.
Full remote command execution and data compromise.

Live Threat

Current exploitation, exposure, and threat context

A low-privileged user could potentially execute arbitrary commands on another organization's server when the Dokploy PaaS is improperly configured. This could impact the integrity and confidentiality of the affected server, potentially leading to service disruption or unauthorized access to data.

Server commands could be executed.
Unauthorized access to other tenants' servers.
Compromise of system integrity and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Platform-as-a-Service (PaaS) solutions like Dokploy are typically managed by platform or infrastructure teams, with security teams responsible for network access and vendor management if applicable. The immediate first step is to confirm the presence of Dokploy within your environment, assess its exposure and criticality, identify the accountable asset owner, and then prioritize remediation actions.

Platform/Infrastructure owns remediation.
Verify Dokploy deployment and reachability.
Plan maintenance for upgrade.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dokploy?

Dokploy is an open-source, self-hosted Platform as a Service (PaaS) used to streamline application deployments. It acts as a management layer that simplifies how developers handle infrastructure, containers, and server resources. Because it centralizes control over multiple servers and applications, it serves as a critical hub for coordinating tasks across a multi-tenant environment.

What does CVE-2026-72876 mean for system security?

This vulnerability involves Improper Neutralization of Special Elements used in an OS Command (CWE-78), alongside authorization bypass issues (CWE-639 and CWE-862). Essentially, the software fails to verify if a user has the right to access a specific server. This allows an authenticated user to trick the system into running unauthorized commands on infrastructure belonging to another tenant.

How is this command execution triggered?

An attacker with 'server:read' permissions triggers the vulnerability by sending crafted API requests to specific swarm-related endpoints. The system fails to check if the caller actually owns the target organization. Crucially, this does not require administrative access; a standard user account with read rights can provide a different server ID to force the system to execute commands on unintended targets.

Is my Dokploy instance at risk?

Halo Surface Signal notes that because Dokploy is a management platform, it is frequently configured as an internet-facing or network-accessible administrative interface. If your instance is reachable over the network, the API endpoints impacted by this flaw may be accessible to unauthorized users, increasing the risk that a low-privileged account could compromise other tenants.

How do I fix this vulnerability?

The primary response is to update your Dokploy installation to version 0.29.13 or later. Before applying the update, verify your current version and ensure the service is properly identified in your asset inventory. Coordinate with your platform or infrastructure team to schedule this maintenance, as it directly addresses the authorization logic gaps that allow for unauthorized command execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.