What is the CVSS score of CVE-2026-45630?

CVE-2026-45630 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of Dokploy are affected by CVE-2026-45630?

Dokploy versions 0.28.8 and earlier contain a critical authenticated command injection vulnerability in the server configuration endpoint that allows privileged users (admins/owners) to execute…

How to fix or mitigate CVE-2026-45630?

24 hours: Audit Dokploy admin/owner account access logs and credential rotation status; enumerate all systems each account can reach. 7 days: Implement network-level restrictions on the Dokploy controller's access to managed servers; disable or revoke unnecessary privileged accounts; enable audit logging on tRPC updateTraefikConfig endpoint calls. 30 days: Subscribe to Dokploy security advisories; establish emergency patching procedures for when vendor patch becomes available.

Dokploy CVE-2026-45630

EUVD-2026-33357 CRITICAL

OS Command Injection (CWE-78)

2026-05-29 GitHub_M

Command Injection Dokploy

9.0

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 17:54 vuln.today

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, authenticated OS command injection in the application.updateTraefikConfig tRPC endpoint allows admin/owner users to execute arbitrary system commands on remote servers via unsanitized echo shell interpolation.

AnalysisAI

Authenticated OS command injection in Dokploy 0.28.8 and earlier lets admin or owner users execute arbitrary shell commands on remote servers managed by the PaaS through the application.updateTraefikConfig tRPC endpoint. The flaw stems from unsanitized shell interpolation in an echo call, granting full command execution across any host the Dokploy controller manages. No public exploit identified at time of analysis, but the high-privilege admin context combined with cross-server reach makes this a meaningful post-compromise escalation path.

Technical ContextAI

Dokploy is a self-hostable Platform-as-a-Service that orchestrates application deployments across remote servers, typically using Traefik as a reverse proxy. The vulnerable code path lives in the application.updateTraefikConfig tRPC endpoint, where user-supplied configuration data is concatenated into a shell echo command without sanitization or argument-separated execution. This is a textbook CWE-78 (OS Command Injection) issue: shell metacharacters such as backticks, $(...), semicolons, or pipes injected into the input break out of the echo argument and execute attacker-chosen commands under the shell that Dokploy uses to push Traefik configuration to managed hosts. Because Dokploy's agent fans out to remote servers, the injection point is effectively a multi-host RCE primitive rather than a single-host bug. The affected CPE is cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to the fixed Dokploy release referenced in GHSA-p787-6gqg-cvp5 (https://github.com/Dokploy/dokploy/security/advisories/GHSA-p787-6gqg-cvp5); the advisory is the authoritative source for the exact patched version, which was not independently confirmed in the input data, so consult the advisory before deploying. As immediate compensating controls until patching, restrict the Dokploy web UI and tRPC API to a trusted management network or VPN so the updateTraefikConfig endpoint is unreachable from the public internet, audit and reduce the set of admin/owner accounts to the minimum, rotate any credentials or session tokens for those accounts, and review Traefik configuration history and shell/audit logs on managed servers for anomalous commands originating from the Dokploy agent - noting that restricting network access will break legitimate remote administration, so plan an out-of-band access path before applying it.