Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-45629: Dokploy PaaS allows authenticated server takeover via command injection

CVE-2026-45629

Summary

Dokploy's self-hosted Platform as a Service (PaaS) has a security issue that affects any organization member with authenticated access. This issue allows users to take control of remote servers managed by Dokploy, which can lead to sensitive data being compromised. Users of Dokploy should update to the latest version to fix this issue.

Original title

Original description

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, authenticated OS command injection in the /listen-deployment WebSocket endpoint allows any organization member to execute arbitrary system commands on remote servers managed by Dokploy, leading to full server compromise.

nvd CVSS3.1 9.9

Vulnerability type

CWE-78 OS Command Injection

https://github.com/Dokploy/dokploy/security/advisories/GHSA-r73h-qr3p-hf7f

Published: 29 May 2026 · Updated: 31 May 2026 · First seen: 29 May 2026