CVE Intelligence
Analysis AI-assisted

CVE-2026-45629: Dokploy: Authenticated Remote Code Execution via Command Injection in /listen-deployment WebSocket Endpoint

Dokploy versions 0.28.8 and earlier contain an authenticated OS command injection flaw in the /listen-deployment WebSocket endpoint. According to the record, any organization member can run arbitrary system commands on servers managed by Dokploy. The record lists no fixed version and no confirmed exploitation in the wild.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Dokploy is a self-hostable Platform as a Service. CVE-2026-45629 describes an OS command injection flaw (CWE-78) in the /listen-deployment WebSocket endpoint. The record states that exploitation requires an authenticated organization member.

Impact

  • Any authenticated organization member may be able to run arbitrary system commands on servers managed by Dokploy.
  • The record describes the result as full server compromise.
  • The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) indicates network reachability, low complexity, low privileges, no user interaction, scope change, and high confidentiality and integrity impact with low availability impact.

Affected products and versions

  • Product: Dokploy Dokploy.
  • Affected: 0.28.8 and earlier, as stated in the record.
  • Fixed version: not listed in the record. Check the GitHub security advisory for remediation details.

Exploitation status

This CVE is not listed in the CISA KEV catalog in the record. No confirmed exploitation in the wild appears in the sources consulted. The record's SSVC data lists exploitation as poc, which points to proof-of-concept availability rather than observed attacks.

Remediation and mitigation

  • Plan an upgrade beyond version 0.28.8 once the fixed release is confirmed in the GitHub advisory.
  • Review organization membership and limit accounts to trusted users, since the flaw requires authentication.
  • Restrict network access to the Dokploy management interface where possible.
  • If compromise is suspected, rotate credentials and secrets held on managed servers.

Detection guidance

  • Review application and web server logs for unusual WebSocket sessions to the /listen-deployment path.
  • Audit recently created or changed deployments and unexpected processes on Dokploy-managed servers.
  • Monitor managed hosts for unexpected outbound connections.

Limitations of the available information

  • The record does not list a fixed version, patch or workaround.
  • The record does not describe the vulnerable code path or detailed exploitation conditions.
  • The EPSS values (probability 0.00942, percentile 0.60657) are statistical estimates and do not confirm attacks.

Frequently asked questions

Is CVE-2026-45629 being exploited in the wild?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation value in the record is poc.

Which Dokploy versions are affected?

The record states that Dokploy 0.28.8 and earlier are affected.

What should administrators do now?

Check the GitHub advisory for the fixed release, plan an upgrade beyond 0.28.8, and limit organization membership and network access to the management interface.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.