What is the CVSS score of CVE-2026-72868?

CVE-2026-72868 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Dokploy are affected by CVE-2026-72868?

Dokploy self-hosted PaaS versions before 0.29.13 contain a critical command injection vulnerability in the S3 destination testing feature that allows low-privileged organization members to execute…. A patch is available.

How to fix or mitigate CVE-2026-72868?

Within 24 hours, inventory all Dokploy deployments and identify installed versions, prioritizing instances running pre-0.29.13 releases. Within 7 days, upgrade all affected installations to v0.29.13 or later; if immediate upgrade is infeasible, disable S3 destination configuration and testing access for all non-administrative users. Within 30 days, verify all deployments are patched, audit access logs for suspicious destination.testConnection activity, and review S3 configurations for signs of compromise.

Dokploy CVE-2026-72868

EUVD-2026-55726 CRITICAL

OS Command Injection (CWE-78)

2026-08-10 GitHub_M

Command Injection Docker Dokploy

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable mutation with no UI, exploitable by a low-privileged member (PR:L), and code runs as root with the host Docker socket, causing a scope change and full C/I/A loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 10, 2026 - 20:04 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 19:25 vuln.today

Analysis Generated

Aug 10, 2026 - 19:25 vuln.today

CVE Published

Aug 10, 2026 - 18:39 cve.org

CRITICAL 9.9

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, secretAccessKey, region, endpoint, provider, and bucket fields from destination.testConnection into an rclone ls command executed through child_process.exec. The withPermission("destination", "create") path permits a low-privileged organization member to reach the mutation, close a quoted argument with a crafted field, and execute arbitrary commands in the root Dokploy container, which has access to the host Docker socket. This issue is fixed in version 0.29.13.

Articles & Coverage 1

News Critical Command Injection in Dokploy Self-Hosted PaaS - CVE-2026-72868 Aug 11, 2026

AnalysisAI

Command injection in Dokploy self-hosted PaaS before 0.29.13 lets a low-privileged organization member run arbitrary OS commands inside the root Dokploy container, which holds the host Docker socket, effectively yielding host takeover. The destination.testConnection mutation interpolates unsanitized S3 fields (accessKey, secretAccessKey, region, endpoint, provider, bucket) into an rclone shell command run via child_process.exec. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Obtain low-privileged org member account

Delivery

Open destination test-connection form

Exploit

Inject shell metacharacters in S3 field

Install

Break out of quoted rclone argument

Execute commands as root in container

Execute

Abuse host Docker socket

Impact

Full host and workload takeover

Recon

Obtain low-privileged org member account

Delivery

Open destination test-connection form

Exploit

Inject shell metacharacters in S3 field

Install

Break out of quoted rclone argument

Execute commands as root in container

Execute

Abuse host Docker socket

Impact

Full host and workload takeover

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated organization member holding the 'destination:create' permission (PR:L), reachable over the network with no user interaction. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine high-priority issue, not an inflated CVSS number. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A low-privileged member of a Dokploy organization opens the destination configuration UI and submits a 'test connection' request with an S3 field such as endpoint or bucket crafted to close the quoted rclone argument and append a shell command (e.g. `"; <command>; "`). …
Remediation	Vendor-released patch: upgrade to Dokploy 0.29.13 or later, which replaces unsafe string interpolation with shell-quote's quote() in the destination, backup, certificate, and mount code paths and adds regex validation for volume names (see GHSA-f6x8-vfwh-8hjr and PR #4873). … Detailed patch versions, workarounds, and compensating controls in full report.