CVE Intelligence
Analysis AI-assisted

CVE-2026-27130: Dokploy OS Command Injection via appName

Dokploy versions 0.26.6 and below are affected by OS command injection through the appName parameter, which an authenticated user can trigger. The issue is fixed in version 0.26.7. The record rates it critical with a CVSS 3.1 score of 9.9 and reports no confirmed active exploitation in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Dokploy is a self-hostable Platform as a Service. According to the GitHub advisory referenced in the record, versions 0.26.6 and below are affected by an OS command injection flaw triggered through the appName parameter. The weakness is classified as CWE-78 and is resolved in version 0.26.7.

Impact

  • Confirmed: the record states that an authenticated user can supply a crafted application name during application creation, and that it is later used in shell commands when service operations such as start, stop, remove and scale run.
  • Inference: successful exploitation would run commands with server-level privileges, which is consistent with the high confidentiality, integrity and availability ratings in the CVSS 3.1 vector.

Affected products and versions

  • Product: Dokploy Dokploy.
  • Affected: versions before 0.26.7 (the description names 0.26.6 and below).
  • Fixed: 0.26.7.

Exploitation status

  • The record shows the vulnerability is not listed in the CISA KEV catalog. No confirmed active exploitation appears in the sources consulted.
  • The SSVC exploitation field in the record is set to poc, which indicates a proof of concept may exist. This is a record value, not confirmation of attacks.
  • The EPSS probability in the record is 0.01219, with a percentile of 0.68445.

Remediation and mitigation

  • Upgrade Dokploy to version 0.26.7 or later.
  • Until the upgrade is applied, restrict who can create or modify applications and review existing application names for unexpected characters.
  • Review service operations on affected instances for unexpected behavior.

Detection guidance

  • Audit application records for names containing shell-significant or unusual characters.
  • Review server logs around application creation and around start, stop, remove and scale events for unexpected processes or commands.
  • Monitor affected hosts for unexpected outbound connections or configuration changes.

Limitations of the available information

  • The fixes field in the record is empty. The fixed version is taken from the description and the affected entry.
  • The record does not provide detection signatures or indicators of compromise.
  • The record marks the source status as Deferred, and the commit referenced in the record was not described in detail.
  • This analysis relies only on the supplied record and the listed references.

Frequently asked questions

Which Dokploy versions are affected by CVE-2026-27130?

The record states that versions 0.26.6 and below are affected, and the affected entry lists versions before 0.26.7.

Is there a fix for this vulnerability?

Yes. The description states the issue is resolved in version 0.26.7, so upgrading to that version or later is the recommended remediation.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.