What is the CVSS score of CVE-2026-24841?

CVE-2026-24841 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of Docker are affected by CVE-2026-24841?

Dokploy instances running versions prior to 0.26.6 are vulnerable to remote command injection through the WebSocket terminal endpoint, allowing unauthenticated attackers to execute arbitrary commands…. A patch is available.

Is there a public PoC exploit available for CVE-2026-24841?

Yes, a public proof-of-concept exploit is available for CVE-2026-24841. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-24841?

Within 24 hours: Identify all Dokploy deployments and their versions; isolate affected instances from production networks if upgrade cannot be completed immediately. Within 7 days: Upgrade all Dokploy instances to version 0.26.6 or later; verify patch application and restart services. Within 30 days: Conduct forensic analysis of affected systems for unauthorized access or command execution; review access logs and audit trails for exploitation attempts; implement network monitoring for WebSocket endpoint anomalies.

Docker CVE-2026-24841

CRITICAL

OS Command Injection (CWE-78)

2026-01-28 security-advisories@github.com

Docker Command Injection Dokploy

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 04, 2026 - 17:37 vuln.today

Public exploit code

Patch released

Feb 04, 2026 - 17:37 nvd

Patch available

CVE Published

Jan 28, 2026 - 01:16 nvd

CRITICAL 9.9

DescriptionGitHub Advisory

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint /docker-container-terminal. The containerId and activeWay parameters are directly interpolated into shell commands without sanitization, allowing authenticated attackers to execute arbitrary commands on the host server. Version 0.26.6 fixes the issue.

AnalysisAI

Dokploy self-hosted PaaS prior to 0.26.6 has a critical command injection vulnerability (CVSS 9.9) allowing authenticated users to execute arbitrary OS commands on the host.

Technical ContextAI

Dokploy < 0.26.6 has a CWE-78 OS command injection vulnerability that allows authenticated users to inject commands that execute on the underlying host system, not just within containers.