What is the CVSS score of CVE-2026-72902?

CVE-2026-72902 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Dokploy are affected by CVE-2026-72902?

Dokploy, a self-hosted deployment platform used by organizations to manage application infrastructure, contains a critical vulnerability in all versions before 0.29.13 that allows authorized users…. A patch is available.

How to fix or mitigate CVE-2026-72902?

Within 24 hours, disable the registry testing functionality (registry.testRegistry and registry.testRegistryById endpoints) unless operationally critical, and restrict Dokploy administrative access to a hardened IP whitelist. Within 7 days, require multi-factor authentication for all Dokploy administrators, enable detailed logging of all command execution on Dokploy hosts, and segregate Dokploy infrastructure from production networks. Within 30 days, deploy Dokploy version 0.29.13 or later once released by the vendor and conduct security testing to verify the vulnerability is remediated.

Dokploy CVE-2026-72902

EUVD-2026-55799 CRITICAL

OS Command Injection (CWE-78)

2026-08-10 GitHub_M

Command Injection Dokploy

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable tRPC endpoint, trivial injection (AC:L), but requires an authenticated account (PR:L); commands run on separate SSH-connected targets justify scope change (S:C) with full C/I/A loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 10, 2026 - 21:05 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 20:20 vuln.today

Analysis Generated

Aug 10, 2026 - 20:20 vuln.today

CVE Published

Aug 10, 2026 - 19:41 cve.org

CRITICAL 9.9

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts interpolate the password field into an execAsyncRemote shell command instead of using safeDockerLoginCommand. This issue is fixed in version 0.29.13.

AnalysisAI

Command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user run arbitrary OS commands on the Dokploy host or any SSH-connected target server. The registry.testRegistry and registry.testRegistryById tRPC endpoints interpolate the attacker-supplied registry password directly into a shell command (echo <password> | docker ...) via execAsyncRemote instead of the safe safeDockerLoginCommand helper. Rated CVSS 9.9; no public exploit identified at time of analysis, though the fix commit publicly reveals the vulnerable code path.

Technical ContextAI

Dokploy is a Node.js/TypeScript Platform-as-a-Service that orchestrates Docker deployments across a local host and remote servers reachable over SSH. The flaw is a classic OS Command Injection (CWE-78): in apps/dokploy/server/api/routers/registry.ts, the registry 'test' handlers built a shell string echo ${input.password} | docker ${args.join(' ')} and executed it remotely with execAsyncRemote. Because the password field is concatenated into the command without escaping or parameterization, shell metacharacters (backticks, $(), ;, |, &&) in the password break out of the intended docker-login context and are executed by the target shell. The patch (PR #4875) replaces the interpolation with safeDockerLoginCommand(registryUrl, username, password), which constructs the login invocation safely rather than through string interpolation.

RemediationAI

Upgrade Dokploy to version 0.29.13 or later, which is the vendor-released patch that replaces the unsafe password interpolation with safeDockerLoginCommand (see release https://github.com/Dokploy/dokploy/releases/tag/v0.29.13 and advisory https://github.com/Dokploy/dokploy/security/advisories/GHSA-w6r4-f26v-8g36). If you cannot upgrade immediately, reduce exposure by restricting who can authenticate to the panel: disable open/self-registration, remove untrusted user accounts, and place the Dokploy web interface behind a VPN or IP allowlist so the registry test endpoints are not broadly reachable - the trade-off is reduced convenience for distributed teams and no protection against an already-authenticated malicious or compromised account. Avoid using or testing untrusted container registry credentials, and audit configured SSH-connected target servers for signs of unexpected command execution. These are stopgaps only; the interpolation flaw is code-level, so patching to 0.29.13 is the sole complete fix.