CVE-2026-45629: Dokploy: Authenticated Remote Code Execution via Command Injection in /listen-deployment WebSocket Endpoint
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, authenticated OS command injection in the /listen-deployment WebSocket endpoint allows any organization member to execute arbitrary system commands on remote servers managed by Dokploy, leading to full server compromise.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
dokployfrom your environment.Uninstall Dokploy if it is not required or take the service offline to prevent exploitation until a fix is available.
- Configuration
If possible, disable the /listen-deployment WebSocket endpoint or disable WebSocket/listen-deployment functionality in Dokploy until a patched release is available.
Dokploy /listen-deployment WebSocket endpoint = disabled - Compensating control
Restrict access to the Dokploy management interface and the /listen-deployment endpoint — e.g., place Dokploy behind a firewall, VPN, or WAF and allow only trusted administrative IPs to connect.
- Operational
Assume full server compromise if this endpoint was accessible; investigate logs, rotate any credentials or keys that could have been exposed, and rebuild/re-image affected servers if compromise is suspected.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45629?
The severity of CVE-2026-45629 is rated as critical with a score of 9.9.
How do I fix CVE-2026-45629?
To fix CVE-2026-45629, upgrade to Dokploy version 0.28.9 or later, which addresses the command injection vulnerability.
What type of vulnerability is CVE-2026-45629?
CVE-2026-45629 is classified as an OS Command Injection vulnerability.
What are the potential impacts of CVE-2026-45629?
The impact of CVE-2026-45629 includes the ability for authenticated users to execute arbitrary commands on remote servers, potentially leading to a complete server compromise.
Who is affected by CVE-2026-45629?
Organizations using Dokploy version 0.28.8 or earlier are affected by CVE-2026-45629.