What is the CVSS score of CVE-2026-45632?

CVE-2026-45632 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Dokploy are affected by CVE-2026-45632?

Dokploy deployment platform versions 0.26.7 and earlier contain a critical authorization bypass allowing any user with valid credentials to execute arbitrary code on other customers' production…

How to fix or mitigate CVE-2026-45632?

Within 24 hours: Audit all Dokploy instances to determine versions in use; restrict user access to essential personnel only; enable audit logging on scheduled task creation and modification. Within 7 days: Confirm vendor patch timeline and commit to upgrade schedule; implement network segmentation if multi-tenant deployment; document all current Dokploy user accounts. Within 30 days: Deploy patched version immediately upon release; forensically review all scheduled task execution logs for unauthorized modifications; validate remediation across all instances.

Dokploy CVE-2026-45632

EUVD-2026-33354 CRITICAL

OS Command Injection (CWE-78)

2026-05-29 GitHub_M

Command Injection Dokploy

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 17:53 vuln.today

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.7 and earlier, the schedule router does not enforce organization/role checks. As a result, any authenticated user can create, update, run, or delete schedules belonging to other organizations if they know the scheduleId/serverId. Schedule types server and dokploy-server write and execute scripts on the host or remote servers, enabling RCE on the Dokploy host or a target server.

AnalysisAI

Cross-tenant remote code execution in Dokploy 0.26.7 and earlier allows any authenticated user to hijack scheduled tasks belonging to other organizations and execute arbitrary scripts on the Dokploy host or managed remote servers. The schedule router fails to enforce organization and role authorization, so knowledge of a scheduleId/serverId is sufficient to create, modify, or trigger server-type schedules that run attacker-controlled shell commands. No public exploit identified at time of analysis, but the trivial authorization bypass combined with built-in script execution makes this a high-priority issue for multi-tenant Dokploy deployments.

Technical ContextAI

Dokploy is a self-hostable PaaS (CPE cpe:2.3:a:dokploy:dokploy) that exposes a multi-tenant control plane where organizations manage deployments, servers, and scheduled jobs. The schedule router handles CRUD and execution endpoints for scheduled tasks, including 'server' and 'dokploy-server' schedule types whose payload is a shell script executed by the platform on either the Dokploy host or a registered remote server. The root cause is CWE-78 (OS Command Injection) manifested through a missing authorization layer: the router accepts a scheduleId/serverId from any authenticated session and dispatches the script to a shell without verifying that the caller's organization owns the target resource or that the caller has a sufficient role, turning an intended tenant-scoped automation feature into a cross-tenant command execution primitive.

RemediationAI

Patch available per vendor advisory GHSA-7wmr-57mg-h5q6 (https://github.com/Dokploy/dokploy/security/advisories/GHSA-7wmr-57mg-h5q6); administrators should upgrade Dokploy to the fixed release referenced there as soon as possible since the input does not include an independently confirmed exact fix version number. Until the upgrade is applied, restrict the Dokploy UI/API to trusted operators only by placing it behind a VPN or IP allowlist, freeze new account creation, and audit existing accounts to remove any low-trust users - accepting the trade-off that legitimate self-service workflows will be paused. As a deeper compensating control, avoid using 'server' and 'dokploy-server' schedule types or remove existing schedules of those types and disable scheduled-task execution where feasible, recognizing that this disables a core automation feature. Finally, review schedule execution logs and host shell history for unexpected script runs to detect prior abuse before patching.