CVE-2026-24841: Dokploy OS Command Injection in WebSocket Container Terminal
CVE-2026-24841 is a critical OS command injection flaw (CWE-78) in the WebSocket endpoint /docker-container-terminal of Dokploy versions prior to 0.26.6. The record states that the containerId and activeWay parameters reach shell commands without sanitization, and that authenticated attackers could run arbitrary commands on the host. Upgrading to 0.26.6 is the remediation stated in the record; no confirmed exploitation appears in the sources consulted.
Overview
Dokploy is a self-hostable Platform as a Service (PaaS). According to the CVE record, versions prior to 0.26.6 contain an OS command injection flaw (CWE-78) in the WebSocket endpoint /docker-container-terminal. The containerId and activeWay parameters are placed into shell commands without sanitization.
Impact
The record states that authenticated attackers could run arbitrary commands on the host server. The CVSS 3.1 base score of 9.9 (critical) published by NVD and the CNA reflects high confidentiality, integrity and availability impact with a scope change, as shown in the vector string.
Affected products and versions
- Product: Dokploy (listed as Dokploy Dokploy in the record)
- Affected: versions prior to 0.26.6
- Fixed: version 0.26.6, according to the record and the vendor advisory
Exploitation status
The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted. The vendor advisory carries an Exploit tag in the reference list, but that tag alone does not establish exploitation in the wild.
Remediation and mitigation
- Upgrade Dokploy to version 0.26.6 or later.
- Review the vendor advisory for the mitigation guidance it provides.
- Review the fix commit to understand the change.
- While patching, limit access to the Dokploy management interface and its WebSocket endpoints to trusted administrators and networks.
Detection guidance
- Review logs for WebSocket connections to the container terminal endpoint, especially from unexpected accounts or addresses.
- Look for unexpected child processes started by the Dokploy service on the host.
- Audit Dokploy user accounts and recent container terminal sessions for activity that does not match administrative work.
Limitations of the available information
- The record gives a short description and does not detail the exact input handling or the conditions beyond authentication.
- The record does not state whether exploitation has been observed.
- EPSS and SSVC data are not available in the record.
- This analysis relies on record metadata and the listed references, not on a review of the fix code.
Frequently asked questions
Which Dokploy versions are affected by CVE-2026-24841?
According to the record, versions prior to 0.26.6 are affected. Version 0.26.6 is stated to fix the issue.
Does the record show active exploitation of this vulnerability?
No. The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.
What should administrators do first?
Upgrade Dokploy to version 0.26.6 or later, review the vendor advisory and fix commit, and restrict access to the management interface and WebSocket endpoints while patching.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.