# CVE-2026-72867: Dokploy - RCE

> Live exploitation tracking for CVE-2026-72867 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-72867

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.9
- **Public exploit available:** Yes
- **Affected products:** Dokploy
- **Weaknesses:** CWE-20 (Improper Input Validation); CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')); CWE-602 (Client-Side Enforcement of Server-Side Security)
- **Tags:** cicd, web_application

## Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trigger compose.deploy, which passes the stored branch to shell-based Git clone commands in packages/server/src/utils/providers/git.ts, github.ts, gitlab.ts, bitbucket.ts, and gitea.ts, resulting in arbitrary host command execution. This issue is fixed in version 0.29.13.

## CrowdSec analysis

[CVE-2026-72867](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-72867) is a critical remote code execution vulnerability in Dokploy versions 0.29.3 through 0.29.12, caused by insufficient server-side validation of Git branch fields. A low-privileged authenticated attacker can submit a malicious branch value and trigger deployment to execute arbitrary commands on the host, potentially compromising its confidentiality, integrity, and availability. The issue is fixed in version 0.29.13.

CrowdSec has been tracking this vulnerability and its exploits since 21st of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-72867 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Authenticated exploitation targets Dokploy’s `/api/trpc/compose.update` endpoint to set a crafted `customGitBranch` value containing shell commands, then triggers execution through `/api/trpc/compose.deploy`. Attack chains may also call `/api/auth/sign-in/email`, `/api/trpc/project.create`, and `/api/trpc/compose.create` to obtain a session and create the required resources.

## Timeline

- 2026-08-10: CVE Published. CVE-2026-72867 is published to NVD.
- 2026-10-21: Rule Released. CrowdSec releases a rule to detect CVE-2026-72867 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/Dokploy/dokploy/releases/tag/v0.29.13
- https://github.com/Dokploy/dokploy/commit/47347ab885b0ad1f5d0ef0e5e74bbba35c7f93bc
- https://github.com/Dokploy/dokploy/security/advisories/GHSA-cg8g-x23v-5fw8
- https://github.com/Dokploy/dokploy/pull/4855
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-72867.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-72867) follows observed exploitation activity for CVE-2026-72867. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.