CVE-2026-24841: Dokploy Vulnerable to Authenticated Remote Code Execution via Command Injection in Docker Container Terminal WebSocket Endpoint
Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint /docker-container-terminal. The containerId and activeWay parameters are directly interpolated into shell commands without sanitization, allowing authenticated attackers to execute arbitrary commands on the host server. Version 0.26.6 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24841?
CVE-2026-24841 has been classified as critical due to its potential for authenticated remote code execution.
How do I fix CVE-2026-24841?
To mitigate CVE-2026-24841, update Dokploy to version 0.26.6 or later.
What versions of Dokploy are affected by CVE-2026-24841?
CVE-2026-24841 affects Dokploy versions prior to 0.26.6.
What type of vulnerability is CVE-2026-24841?
CVE-2026-24841 is a command injection vulnerability located in the WebSocket endpoint of Dokploy.
Can CVE-2026-24841 be exploited remotely?
Yes, CVE-2026-24841 can be exploited remotely, allowing attackers to execute commands on the server.