# cve.now: Dokploy

The newest entries naming Dokploy as an affected vendor (up to 200), of 59 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-116068](https://cve.now/CVE-2026-116068.md): Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router (CVSS 8.7)
- [CVE-2026-111331](https://cve.now/CVE-2026-111331.md): Dokploy through 0.30.8 Cross-Organization Authorization Bypass via port tRPC Router (CVSS 5.3)
- [CVE-2026-93425](https://cve.now/CVE-2026-93425.md): Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root (CVSS 9.9)
- [CVE-2026-86059](https://cve.now/CVE-2026-86059.md): Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one (CVSS 9.6)
- [CVE-2026-45791](https://cve.now/CVE-2026-45791.md): Dokploy: Password Change Does Not Revoke Active Sessions (CVSS 5.9)
- [CVE-2026-45790](https://cve.now/CVE-2026-45790.md): Dokploy: Invitation Role Escalation Allows Organization Takeover (CVSS 8.0)
- [CVE-2026-72902](https://cve.now/CVE-2026-72902.md): Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryById (CVSS 9.9)
- [CVE-2026-72901](https://cve.now/CVE-2026-72901.md): Dokploy: Remote Code Execution via volume-backup (CVSS 9.9)
- [CVE-2026-72886](https://cve.now/CVE-2026-72886.md): Dokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of CVE-2026-45632) (CVSS 9.9)
- [CVE-2026-72885](https://cve.now/CVE-2026-72885.md): Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builder (CVSS 0.0)
- [CVE-2026-72884](https://cve.now/CVE-2026-72884.md): Dokploy: Command Injection via Compose Custom Command (CVSS 8.7)
- [CVE-2026-72883](https://cve.now/CVE-2026-72883.md): Dokploy: WebSocket Terminal Missing Service-Level Access Control (CVSS 8.8)
- [CVE-2026-72882](https://cve.now/CVE-2026-72882.md): Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers (CVSS 9.9)
- [CVE-2026-72881](https://cve.now/CVE-2026-72881.md): Dokploy: Command Injection via database credentials in backup/restore commands (CVSS 6.4)
- [CVE-2026-72880](https://cve.now/CVE-2026-72880.md): Dokploy: Arbitrary File Write + Remote OS Command Injection via \`certificatePath\` (CVSS 9.9)
- [CVE-2026-72879](https://cve.now/CVE-2026-72879.md): Dokploy: Command Injection via Registry Credentials in Swarm Upload (CVSS 9.4)
- [CVE-2026-72878](https://cve.now/CVE-2026-72878.md): Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell arguments (CVSS 9.6)
- [CVE-2026-72877](https://cve.now/CVE-2026-72877.md): Dokploy: Command Injection via dockerImage in buildRemoteDocker (CVSS 9.6)
- [CVE-2026-72876](https://cve.now/CVE-2026-72876.md): Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.\* (CVSS 9.9)
- [CVE-2026-72875](https://cve.now/CVE-2026-72875.md): Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFile (CVSS 8.8)
- [CVE-2026-72874](https://cve.now/CVE-2026-72874.md): Dokploy: Command Injection via Unescaped Git URL in Clone Commands (CVSS 8.7)
- [CVE-2026-72873](https://cve.now/CVE-2026-72873.md): Dokploy: Cross-tenant Git provider secrets are disclosed to low-privileged service readers via \`application.one\` (CVSS 6.5)
- [CVE-2026-72872](https://cve.now/CVE-2026-72872.md): Dokploy: OS Command Injection via Bitbucket \`owner\`/\`repository\` in \`git clone\` (CVSS 9.9)
- [CVE-2026-72871](https://cve.now/CVE-2026-72871.md): Dokploy: Unauthenticated Git Provider Injection via GitHub OAuth Callback (CVSS 7.5)
- [CVE-2026-72870](https://cve.now/CVE-2026-72870.md): Dokploy: Command Injection via Docker Credentials in buildRemoteDocker (CVSS 8.7)
- [CVE-2026-72869](https://cve.now/CVE-2026-72869.md): Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE (CVSS 9.9)
- [CVE-2026-72868](https://cve.now/CVE-2026-72868.md): Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection (CVSS 9.9)
- [CVE-2026-72867](https://cve.now/CVE-2026-72867.md): Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts) (CVSS 9.9)
- [CVE-2026-72866](https://cve.now/CVE-2026-72866.md): WebSocket Terminal Auth Bypass (CVSS 8.8)
- [CVE-2026-72865](https://cve.now/CVE-2026-72865.md): Dokploy: OS Command Injection via compose \`composePath\` (CVSS 9.9)
- [CVE-2026-72864](https://cve.now/CVE-2026-72864.md): Dokploy Broken Access Control on docker-container-terminal WebSocket (Member -\> Root in Arbitrary Containers) (CVSS 9.9)
- [CVE-2026-72863](https://cve.now/CVE-2026-72863.md): Dokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker host (CVSS 9.9)
- [CVE-2026-72862](https://cve.now/CVE-2026-72862.md): Dokploy: OS Command Injection via dockerImage field in database service deployment functions → HOST RCE (CVSS 9.9)
- [CVE-2026-72740](https://cve.now/CVE-2026-72740.md): Dokploy: OS Command Injection via SSH-form \`customGitUrl\` domain in \`ssh-keyscan\` (CVSS 9.9)
- [CVE-2026-72739](https://cve.now/CVE-2026-72739.md): Dokploy: Command Injection via Compose Shell Execution (CVSS 6.5)
- [CVE-2026-72738](https://cve.now/CVE-2026-72738.md): Dokploy: Authenticated RCE via Command Injection in backup.listBackupFiles search Parameter (CVSS 9.9)
- [CVE-2026-72737](https://cve.now/CVE-2026-72737.md): Dokploy: Cross-organization IDOR in Dokploy backup destinations exposes another tenant's S3 credentials and backups (CVSS 9.6)
- [CVE-2026-72736](https://cve.now/CVE-2026-72736.md): Dokploy: OS Command Injection in registry credential testing and Swarm cluster management → HOST RCE (CVSS 9.9)
- [CVE-2026-72735](https://cve.now/CVE-2026-72735.md): Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescaped YAML in SSH remote execution (CVSS 9.9)
- [CVE-2026-72734](https://cve.now/CVE-2026-72734.md): Dokploy: Cross-organization authorization bypass in server.remove allows deletion of another organization's server registration (CVSS 8.4)
- [CVE-2026-72733](https://cve.now/CVE-2026-72733.md): Dokploy: OS Command Injection via \`databaseName\` / \`backupFile\` in database restore (CVSS 9.9)
- [CVE-2026-45629](https://cve.now/CVE-2026-45629.md): Dokploy: Authenticated Remote Code Execution via Command Injection in /listen-deployment WebSocket Endpoint (CVSS 9.9)
- [CVE-2026-43917](https://cve.now/CVE-2026-43917.md): Dokploy: Cross-Organization IDOR - Multiple tRPC endpoints missing activeOrganizationId validation (CVSS 5.3)
- [CVE-2026-45628](https://cve.now/CVE-2026-45628.md): Dokploy: Command Injection via Unescaped Branch Fields in Deployment Pipeline (CVSS 9.6)
- [CVE-2026-45630](https://cve.now/CVE-2026-45630.md): Dokploy: Authenticated Remote Code Execution via Command Injection in updateTraefikConfig Echo Statement (CVSS 9.0)
- [CVE-2026-45631](https://cve.now/CVE-2026-45631.md): Dokploy: Pre-Auth Admin Takeover via Hardcoded Authentication Secret (CVSS 10.0)
- [CVE-2026-45632](https://cve.now/CVE-2026-45632.md): Dokploy: Schedule Authorization Bypass Enables Host/Server Command Execution (CVSS 9.9)
- [CVE-2026-45633](https://cve.now/CVE-2026-45633.md): Dokploy: Command Injection in /docker-container-logs Endpoint (CVSS 9.9)
- [CVE-2026-45661](https://cve.now/CVE-2026-45661.md): Dokploy: Remote Code Execution through Path Traversal (CVSS 9.9)
- [CVE-2026-45662](https://cve.now/CVE-2026-45662.md): Dokploy: Command Injection via incomplete shell escaping in docker logout (registry deletion) (CVSS 8.8)
- [CVE-2026-45663](https://cve.now/CVE-2026-45663.md): Dokploy: Remote Code Execution via destinationPath in Container File Upload (CVSS 9.9)
- [CVE-2026-27130](https://cve.now/CVE-2026-27130.md): Dokploy has Command Injection in its Service Operations (CVSS 9.9)
- [CVE-2026-24841](https://cve.now/CVE-2026-24841.md): Dokploy Vulnerable to Authenticated Remote Code Execution via Command Injection in Docker Container Terminal WebSocket Endpoint (CVSS 9.9)
- [CVE-2026-24840](https://cve.now/CVE-2026-24840.md): Dokploy uses hardcoded credentials in installation script, which could result in database access (CVSS 8.0)
- [CVE-2026-24839](https://cve.now/CVE-2026-24839.md): Dokploy has a clickjacking vulnerability - Missing X-Frame-Options and CSP frame-ancestors headers (CVSS 4.7)
- [CVE-2025-53825](https://cve.now/CVE-2025-53825.md): Dokploy's Preview Deployments are vulnerable to Remote Code Execution (CVSS 9.4)
- [CVE-2025-53375](https://cve.now/CVE-2025-53375.md): Dokploy allows attackers to read any file that the Traefik process user can access (CVSS 4.9)
- [CVE-2025-53376](https://cve.now/CVE-2025-53376.md): Dokploy allows attackers to run arbitrary OS commands on the Dokploy host. (CVSS 6.3)
- [CVE-2025-53374](https://cve.now/CVE-2025-53374.md): Dokploy Improperly Discloses User Information via user.one Endpoint (CVSS 1.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/dokploy
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.