CVE-2026-24840: Dokploy uses hardcoded credentials in installation script, which could result in database access
Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a hardcoded credential in the provided installation script (located at https://dokploy.com/install.sh, line 154) uses a hardcoded password when creating the database container. This means that nearly all Dokploy installations use the same database credentials and could be compromised. Version 0.26.6 contains a patch for the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24840?
CVE-2026-24840 is a critical vulnerability due to hardcoded credentials that can lead to unauthorized database access.
How do I fix CVE-2026-24840?
To fix CVE-2026-24840, upgrade to Dokploy version 0.26.6 or later where the hardcoded credentials are removed.
What versions of Dokploy are affected by CVE-2026-24840?
CVE-2026-24840 affects all Dokploy versions prior to 0.26.6.
What risks are associated with CVE-2026-24840?
The risks associated with CVE-2026-24840 include potential unauthorized access to the database and compromise of sensitive data.
Where can I find more details about CVE-2026-24840?
More details about CVE-2026-24840 can be found in the advisory posted on the official Dokploy GitHub repository.