CVE-2026-72879: Dokploy: Command Injection via Registry Credentials in Swarm Upload
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.8, the getRegistryCommands() function in packages/server/src/utils/cluster/upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. An authenticated user with project access can configure malicious registry credentials and trigger a swarm deployment to execute arbitrary OS commands on the Dokploy server, read or modify host files, and access other containers through Docker. This issue is fixed in version 0.29.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.29.8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72879?
CVE-2026-72879 has a risk rating of 74, indicating it is a medium to high severity vulnerability.
How do I fix CVE-2026-72879?
To fix CVE-2026-72879, upgrade Dokploy to version 0.29.8 or later where the command injection issue has been resolved.
What type of vulnerability is CVE-2026-72879?
CVE-2026-72879 is categorized as an OS Command Injection vulnerability.
Who is affected by CVE-2026-72879?
CVE-2026-72879 affects authenticated users of Dokploy versions prior to 0.29.8.
What is the main exploit vector for CVE-2026-72879?
The main exploit vector for CVE-2026-72879 is the inappropriate interpolation of registry.password and registry.registryUrl into shell commands without proper escaping.