CVE-2026-72879

If you're running Dokploy, treat this as a host-compromise vulnerability, not a typical command injection. The flaw is in the registry configuration endpoint: authenticated users with project access can inject arbitrary shell commands through credential strings that get directly interpolated into Docker exec calls. The attack surface is anyone with project membership — which in a self-hosted PaaS means you cannot rely on 'authenticated user' as a trust boundary. Check your running version immediately. The vulnerability was patched in 0.29.8. If you're on an earlier version, upgrade. But the patch alone isn't sufficient: examine the commit diff to verify the fix uses proper parameterization (argument arrays passed to exec, not string interpolation) rather than input sanitization layered on the same dangerous data flow. Sanitization can be bypassed; parameterized calls cannot. The blast radius here is worse than the CVSS suggests. Dokploy exposes the Docker socket to the application layer — when this vulnerability executes, it's not just breaking out of a container; it's running commands against the host's Docker daemon. That means full container compromise, access to volumes and networks across all projects, and lateral movement to any system reachable from the host. In a multi-tenant Dokploy instance, one project's member can reach into other tenants' workloads through the shared Docker socket. There is no isolation layer between tenants at the Docker level. Beyond upgrading, audit your Dokploy instance for other configuration endpoints that might have the same string-interpolation-into-shell pattern. This vulnerability likely isn't an isolated flaw — it's one instance of a recurring pattern in PaaS tooling where developer convenience (wiring config inputs directly to exec calls) outpaced security review. Check your logs for any registry configuration activity from the period before patching. Assume that if an attacker knew about this bug before the disclosure, they may have already exploited it — review authentication logs for project members executing unusual commands around the time of your earliest vulnerable version.

Reviewed through automated stages and approved by a human before publication.