What is the CVSS score of CVE-2026-45629?

CVE-2026-45629 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of Dokploy are affected by CVE-2026-45629?

Dokploy 0.28.8 and earlier contain a critical vulnerability allowing any authenticated organizational member to execute arbitrary commands on all connected remote servers through the…

How to fix or mitigate CVE-2026-45629?

24 hours: Audit all Dokploy instances to identify systems running versions 0.28.8 or earlier; implement network-level access controls restricting /listen-deployment WebSocket endpoint access to known internal sources only; rotate all service account credentials accessible through Dokploy. 7 days: Deploy Web Application Firewall rules to detect and block suspicious WebSocket command patterns on the /listen-deployment endpoint; enable comprehensive logging of all WebSocket connections and executed commands; audit organizational membership and remove inactive or unnecessary accounts. 30 days: Monitor GHSA-r73h-qr3p-hf7f for vendor-released patch availability; if no patch available within 30 days, evaluate migration to alternative PaaS solutions or implementation of complete network isolation for affected deployments; document and test backup deployment procedures independent of Dokploy.

Dokploy CVE-2026-45629

EUVD-2026-33362 CRITICAL

OS Command Injection (CWE-78)

2026-05-29 GitHub_M

Command Injection Dokploy

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 17:54 vuln.today

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, authenticated OS command injection in the /listen-deployment WebSocket endpoint allows any organization member to execute arbitrary system commands on remote servers managed by Dokploy, leading to full server compromise.

AnalysisAI

Authenticated OS command injection in Dokploy 0.28.8 and earlier lets any organization member execute arbitrary system commands on remote servers managed by the PaaS via the /listen-deployment WebSocket endpoint, resulting in full server compromise. With a CVSS 9.9 (scope changed) and low-privilege precondition, the flaw effectively turns any low-tier org account into a foothold on every connected host. No public exploit identified at time of analysis, but the vendor security advisory (GHSA-r73h-qr3p-hf7f) confirms the issue.

Technical ContextAI

Dokploy is a self-hostable Platform-as-a-Service that orchestrates deployments to remote servers via an agent/SSH model, exposing real-time deployment streams over WebSockets. The vulnerable /listen-deployment endpoint passes attacker-controlled input into an OS command without sufficient neutralization of shell metacharacters, the classic CWE-78 (OS Command Injection) pattern. Because Dokploy executes deployment-related commands on managed remote hosts under privileged service accounts, injected payloads run with the same privileges Dokploy uses to manage those servers, expanding impact beyond the Dokploy control plane (reflected in the CVSS Scope:Changed designation). The CPE cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:* indicates all Dokploy versions are in scope until a fixed release is identified.

RemediationAI

No vendor-released patch version is identified in the supplied data; consult the Dokploy advisory at https://github.com/Dokploy/dokploy/security/advisories/GHSA-r73h-qr3p-hf7f for the fixed release and upgrade once it is published past 0.28.8. Until a fixed version can be deployed, restrict organization membership to fully trusted operators and audit existing members, since the bug is exploitable by any org member; review invite flows and disable self-registration. As compensating controls, place the Dokploy UI/API behind a VPN or IP allowlist to limit who can reach the /listen-deployment WebSocket endpoint, and reverse-proxy filtering that drops or sanitizes that path can reduce exposure at the cost of breaking legitimate live deployment log streaming. Rotate any SSH keys, API tokens, and registry credentials accessible to Dokploy if you cannot rule out prior abuse.