External risk intelligence

Dokploy Docker Image Field Command Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-72877

Dokploy is a self-hostable Platform as a Service (PaaS) designed to manage application deployments and infrastructure. As a centralized management platform, it is commonly deployed as an internet-facing service to facilitate remote access for developers, manage build processes, and interact with external repositories or cloud targets.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in Dokploy, a self-hostable Platform as a Service, that could allow an authenticated user to execute arbitrary commands on the build host. This could expose sensitive information and other projects. The issue is resolved in version 0.29.13.

Allows command execution via image field.
Affects deployment and build host systems.
Confirm relevance to current infrastructure.

Attack Path

How an attacker could exploit the issue

An attacker with the ability to create or update applications in Dokploy can leverage a flaw in how the `dockerImage` field is handled. By injecting specially crafted input into this field, an attacker can trick the system into executing arbitrary commands on the server where Dokploy is hosted or on a connected remote build target. This could allow them to access sensitive information or compromise other projects managed by Dokploy.

Authenticated user with create/update permissions.
Inject commands into the `dockerImage` field.
Execute arbitrary commands on the host.

Live Threat

Current exploitation, exposure, and threat context

An authenticated user with application creation or update permissions could execute arbitrary commands on the build host. This could expose sensitive information from the build environment, including secrets and other projects hosted on the same system.

Host secrets and projects.
Arbitrary command execution via `dockerImage`.
Unauthorized access to sensitive information.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for Dokploy, including application owners, infrastructure teams, and security teams, should first identify all instances of the affected technology. Confirming reachability and business criticality for each instance will inform risk-based remediation planning, potentially involving vendor coordination or temporary mitigation if immediate patching is not feasible.

Application and infrastructure teams own the issue.
Verify reachability and business criticality first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dokploy?

Dokploy is an open-source, self-hosted Platform as a Service (PaaS). It functions as a management layer that simplifies deploying, monitoring, and scaling containerized applications, often acting as a central hub for development teams to manage build processes and server infrastructure.

What does CVE-2026-72877 mean for Dokploy?

This vulnerability is classified as Improper Neutralization of Special Elements used in an OS Command, or CWE-78. In simple terms, the software fails to properly sanitize the dockerImage input field, allowing it to be used as a vehicle to inject and run unauthorized system-level commands during the build process.

How can an attacker trigger this command injection?

An attacker needs existing application create or update permissions within the platform. They trigger the flaw by inserting malicious shell commands into the dockerImage field. Simply viewing the application settings or having read-only access does not trigger this vulnerability.

Why should I care if my Dokploy instance is reachable?

Halo Surface Signal notes that Dokploy is often deployed as an internet-facing service to enable remote developer access. Because this platform manages infrastructure and build targets, an attacker who reaches the login page can use these permissions to compromise the underlying host and access stored secrets.

What is the first step to secure my Dokploy environment?

Start by identifying all deployed instances within your network to determine their reachability and business role. Once identified, prioritize updating to version 0.29.13 or later, which contains the necessary code changes to correctly handle and quote the dockerImage input.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.