Dokploy vulnerabilities
We track 52 vulnerabilities in Dokploy products. 52 are rated high or critical, and none are known to be exploited. The most recent was published on November 14, 2026.
Latest Dokploy vulnerabilities
- 9.9 Critical severity
dokploy: Improper Neutralization of Special Elements used in an OS Command
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.7 and earlier, the schedule router does not enforce organization/role checks. As a result, any authenticated user can create, update, run, or delete schedules belonging to other organizatio
- 10.0 Critical severity
dokploy: Use of Hard-coded Credentials
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.27.0 to before 0.29.3, a hardcoded BETTER_AUTH_SECRET fallback ("better-auth-secret-123456789") lets an unauthenticated attacker forge email verification JWTs, trigger auto-sign-in as admin,
- 9.0 Critical severity
dokploy: Improper Neutralization of Special Elements used in an OS Command
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, authenticated OS command injection in the application.updateTraefikConfig tRPC endpoint allows admin/owner users to execute arbitrary system commands on remote servers via un
- 9.9 Critical severity
dokploy: Improper Neutralization of Special Elements used in an OS Command
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, authenticated OS command injection in the /listen-deployment WebSocket endpoint allows any organization member to execute arbitrary system commands on remote servers managed
- 9.6 Critical severity
Dokploy is a free, self-hostable Platform as a Service (PaaS).
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.2 and earlier, Dokploy constructs shell commands using JavaScript template literals and executes them via child_process.exec() (which runs through /bin/sh -c). User-supplied branch names, r
- 9.9 Critical severity
dokploy: Improper Neutralization of Special Elements used in a Command
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.1 and earlier, a command injection vulnerability exists in the Docker file upload functionality. When an authenticated user uploads a file to a container, the destinationPath parameter is n
- 8.8 High severity
dokploy: Improper Neutralization of Special Elements used in an OS Command
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.0 and earlier, the deleteRegistry function in Dokploy (packages/server/src/services/registry.ts) executes docker logout ${response.registryUrl} without shell escaping. In the same file, the
- 9.9 Critical severity
dokploy: Improper Neutralization of Special Elements used in an OS Command
Dokploy is a free, self-hostable Platform as a Service (PaaS). Versions 0.26.6 and below have OS command injection through the appName parameter. 3 chained issues cause this problem: inadequate input sanitization, lack of schema validation and direct shell int
- 9.9 Critical severity
dokploy: Improper Neutralization of Special Elements used in an OS Command
Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint `/docker-container-terminal`. The `containerId` and `activeWay` parameters are directl
- 8.8 High severity
dokploy: Use of Hard-coded Credentials
Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a hardcoded credential in the provided installation script (located at https://dokploy.com/install.sh, line 154) uses a hardcoded password when creating the database co
- 9.8 Critical severity
dokploy: Missing Authorization
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to version 0.24.3, an unauthenticated preview deployment vulnerability in Dokploy allows any user to execute arbitrary code and access sensitive environment variables by simply opening a pull
- 8.8 High severity
dokploy: Improper Neutralization of Special Elements used in an OS Command
Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated, low-privileged user can run arbitrary OS commands on the Dokploy host. The tRPC procedure docker.getContainer