CVE-2026-45630
Dokploy, a self‑hosted Platform as a Service, has a critical flaw that lets authenticated admin or owner users run arbitrary system commands on the server. The issue stems from unsanitized echo shell interpolation in the updateTraefikConfig endpoint. An attacker could use this to take full control of the host.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Dokploy versions 0.28.8 and earlier, used by administrators and owners of self‑hosted PaaS deployments.
Real-world impact
An attacker with admin or owner credentials could execute any command on the server, potentially compromising the entire system and all data it hosts.
Why this severity
The CVSS score of 9 reflects the high impact: while the vulnerability requires authenticated access, it grants the attacker the ability to run arbitrary commands, giving them full control (high confidentiality and integrity impact, low availability impact).
What to do about it
- ›Upgrade to a Dokploy version newer than 0.28.8 if available.
- ›Restrict admin/owner access to trusted users only.
- ›Monitor server logs for suspicious command execution attempts.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
NVD description
Timeline
- May 29, 2026 · May 29, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.