CVE-2026-45633: Dokploy: Command Injection in /docker-container-logs Endpoint
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.6 and earlier, Dokploy contains a command injection vulnerability in the /docker-container-logs WebSocket endpoint. The tail and since parameters are not validated and are directly concatenated into shell commands, allowing authenticated users to execute arbitrary commands with root privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement strict input validation and sanitization for the 'tail' and 'since' parameters so they are not directly concatenated into shell commands; reject or sanitize any input containing shell metacharacters.
Dokploy /docker-container-logs WebSocket endpoint tail and since parameter validation = validate and sanitize - Configuration
If a code-level fix is not immediately available, disable the /docker-container-logs WebSocket endpoint or restrict its availability (e.g., via application configuration) until the vulnerability is fixed.
Dokploy /docker-container-logs WebSocket endpoint endpoint availability = disabled or restricted - Compensating control
Restrict access to the management/API and the /docker-container-logs endpoint using network controls (firewall, VPN, ACLs) and limit access to trusted IPs and users to reduce exposure to authenticated user command injection.
- Operational
Investigate for evidence of exploitation (review logs and access to the /docker-container-logs endpoint) and, if compromise is suspected, perform remediation such as system recovery and rotating any credentials or secrets that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45633?
CVE-2026-45633 has a severity rating of critical, with a score of 9.9.
How do I fix CVE-2026-45633?
To fix CVE-2026-45633, update Dokploy to version 0.26.7 or later.
What type of vulnerability is CVE-2026-45633?
CVE-2026-45633 is classified as a command injection vulnerability.
What is affected by CVE-2026-45633?
CVE-2026-45633 affects Dokploy versions 0.26.6 and earlier.
What are the potential impacts of exploiting CVE-2026-45633?
Exploitation of CVE-2026-45633 can lead to unauthorized command execution on the server.