CVE-2026-45631
Dokploy, a self‑hosted Platform as a Service, had a hard‑coded secret that let attackers forge email verification tokens. This flaw allowed unauthenticated users to log in as an administrator and run commands on the host. The issue was fixed in version 0.29.3.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Dokploy PaaS versions 0.27.0 through 0.29.2 (any earlier releases are unaffected).
Real-world impact
An attacker could create a valid JWT, automatically sign in as the admin user, and then use the built‑in SSH terminal to execute arbitrary commands on the server, effectively taking full control of the host.
Why this severity
The CVSS score of 10 reflects that the vulnerability requires no authentication, gives attackers full confidentiality, integrity, and availability compromise, and can be exploited remotely over the network.
What to do about it
- 01Upgrade Dokploy to version 0.29.3 or later.
- 02Restart the Dokploy service to apply the update.
NVD-referenced vendor advisory
Timeline
- May 29, 2026 · May 29, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.
- Jul 25, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.