CVE-2026-72868: Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, secretAccessKey, region, endpoint, provider, and bucket fields from destination.testConnection into an rclone ls command executed through childprocess.exec. The withPermission("destination", "create") path permits a low-privileged organization member to reach the mutation, close a quoted argument with a crafted field, and execute arbitrary commands in the root Dokploy container, which has access to the host Docker socket. This issue is fixed in version 0.29.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.29.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72868?
CVE-2026-72868 has a critical severity rating of 9.9.
What type of vulnerability is represented by CVE-2026-72868?
CVE-2026-72868 is classified as an OS Command Injection vulnerability.
How do I fix CVE-2026-72868?
To fix CVE-2026-72868, upgrade Dokploy to version 0.29.13 or later.
What software is affected by CVE-2026-72868?
CVE-2026-72868 affects Dokploy, specifically versions prior to 0.29.13.
What can attackers achieve by exploiting CVE-2026-72868?
Exploiting CVE-2026-72868 allows attackers to execute remote commands as host root via shell injection.