Vulnerability · Published Jan 28, 2026 · Assigned by GitHub_M

CVE-2026-24841Dokploy Vulnerable to Authenticated Remote Code Execution via Command Injection in Docker Container Terminal WebSocket Endpoint

Critical 9.9

In plain English

A critical-severity OS command injection in dokploy from Dokploy. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 86% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)2.8%top 13.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint `/docker-container-terminal`. The `containerId` and `activeWay` parameters are directly interpolated into shell commands without sanitization, allowing authenticated attackers to execute arbitrary commands on the host server. Version 0.26.6 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
Dokploy	dokploy	< 0.26.6

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

References

https://github.com/Dokploy/dokploy/security/advisories/GHSA-vx6x-6559-x35r x_refsource_CONFIRM
https://github.com/Dokploy/dokploy/commit/74e0bd5fe3ef7199f44fcd19c6f5a2f09b806d6f x_refsource_MISC
https://github.com/Dokploy/dokploy/blob/canary/apps/dokploy/server/wss/docker-container-terminal.ts x_refsource_MISC