What is the CVSS score of EUVD-2026-33353?

EUVD-2026-33353 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Dokploy are affected by EUVD-2026-33353?

Dokploy self-hosted deployment platform versions 0.26.6 and earlier contain a critical root-access vulnerability exploitable by any active user account, enabling complete takeover of managed…

How to fix or mitigate EUVD-2026-33353?

24 hours: Restrict network access to /docker-container-logs WebSocket endpoint via firewall; audit and validate all active user sessions; enable MFA on all accounts. 7 days: Implement WAF or firewall rules blocking shell command injection patterns in WebSocket parameters; establish continuous monitoring for WebSocket-based exploitation attempts; identify all affected Dokploy instances and document versions in deployment inventory. 30 days: Apply vendor-released patch immediately upon availability; if patch unavailable after 30 days, escalate remediation decision to executive leadership and prepare mitigation plan including system isolation or alternative deployment solutions.

Dokploy EUVD-2026-33353

| CVE-2026-45633 CRITICAL

OS Command Injection (CWE-78)

2026-05-29 GitHub_M

Docker Command Injection

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 17:52 vuln.today

CVE Published

May 29, 2026 - 16:10 nvd

CRITICAL 9.9

DescriptionGitHub Advisory

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.6 and earlier, Dokploy contains a command injection vulnerability in the /docker-container-logs WebSocket endpoint. The tail and since parameters are not validated and are directly concatenated into shell commands, allowing authenticated users to execute arbitrary commands with root privileges.

AnalysisAI

Authenticated command injection in Dokploy 0.26.6 and earlier enables any logged-in user to run arbitrary OS commands as root via the /docker-container-logs WebSocket endpoint. The tail and since parameters are concatenated into shell commands without validation, yielding a CVSS 9.9 (Scope:Changed) issue affecting this self-hosted PaaS. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

Dokploy is an open-source, self-hostable Platform-as-a-Service that orchestrates Docker containers, comparable to Heroku/Vercel-style deployments. The flaw is a classic CWE-78 (OS Command Injection): user-controlled parameters (tail, since - typically numeric arguments forwarded to docker logs --tail=N --since=T) are interpolated directly into a shell string rather than passed as argv elements or sanitized against an allow-list. Because the Dokploy server process manages Docker on the host, the resulting command runs in the privilege context of the daemon, which per the advisory equates to root. Exposure surface is a WebSocket endpoint (/docker-container-logs), meaning exploitation rides on the same upgraded HTTP session used by the dashboard. The single CPE - cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:* - confirms all versions through 0.26.6 are in scope.

RemediationAI

Upgrade to the fixed Dokploy release identified in GHSA-wmqj-wr9q-327p (https://github.com/Dokploy/dokploy/security/advisories/GHSA-wmqj-wr9q-327p); the input data does not include the exact fix version, so confirm the patched version directly from the advisory before deploying. Until upgraded, restrict network reachability of the Dokploy UI/API to trusted operators only (VPN, IP allow-list, or reverse-proxy auth in front of the dashboard) - this blocks the network attack vector but breaks remote team access. Additionally, audit and reduce the number of accounts that can authenticate to the Dokploy instance, since the vulnerability requires only a low-privilege session; revoke shared or stale credentials, with the trade-off of operational friction for legitimate collaborators. As a partial mitigation, block or proxy-filter WebSocket upgrade requests to /docker-container-logs at an upstream reverse proxy, accepting the side effect that the in-app container log viewer will stop working for all users.