CVE-2026-45633
Dokploy, a free self-hosted Platform as a Service, has a critical command injection flaw in its /docker-container-logs WebSocket endpoint. In versions 0.26.6 and earlier, authenticated users can supply unvalidated tail and since parameters that are concatenated into shell commands, enabling them to run arbitrary commands as root. This vulnerability could let attackers take full control of the host system.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Dokploy 0.26.6 and earlier (self-hosted PaaS).
Real-world impact
Authenticated users can execute arbitrary commands with root privileges, potentially taking full control of the host system, compromising data, and enabling further attacks.
Why this severity
The CVSS score of 9.9 reflects the high impact on confidentiality, integrity, and availability, and the fact that the vulnerability is exploitable over the network with low effort and requires only low privileges. The attacker can run commands as root, making it a critical risk.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- May 29, 2026 · May 29, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.