Dokploy - RCE (CVE-2026-72867)
Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trigger compose.deploy, which passes the stored branch to shell-based Git clone commands in packages/server/src/utils/providers/git.ts, github.ts, gitlab.ts, bitbucket.ts, and gitea.ts, resulting in arbitrary host command execution. This issue is fixed in version 0.29.13.
psychologyCrowdSec Analysis
CVE-2026-72867 is a critical remote code execution vulnerability in Dokploy versions 0.29.3 through 0.29.12, caused by insufficient server-side validation of Git branch fields. A low-privileged authenticated attacker can submit a malicious branch value and trigger deployment to execute arbitrary commands on the host, potentially compromising its confidentiality, integrity, and availability. The issue is fixed in version 0.29.13.
CrowdSec has been tracking this vulnerability and its exploits since 21st of October 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-72867 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Authenticated exploitation targets Dokploy’s /api/trpc/compose.update endpoint to set a crafted customGitBranch value containing shell commands, then triggers execution through /api/trpc/compose.deploy. Attack chains may also call /api/auth/sign-in/email, /api/trpc/project.create, and /api/trpc/compose.create to obtain a session and create the required resources.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-08-10 |
| Rule Released | 2026-10-21 |
Related Weaknesses
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
Remediation & Protection
External References
- https://github.com/Dokploy/dokploy/releases/tag/v0.29.13
- https://github.com/Dokploy/dokploy/commit/47347ab885b0ad1f5d0ef0e5e74bbba35c7f93bc
- https://github.com/Dokploy/dokploy/security/advisories/GHSA-cg8g-x23v-5fw8
- https://github.com/Dokploy/dokploy/pull/4855
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-72867.yaml