Vulnerability · Published Aug 10, 2026 · Assigned by GitHub_M

CVE-2026-72868Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection

Critical 9.9

In plain English

A critical-severity OS command injection in dokploy from Dokploy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)0.7%top 46.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, secretAccessKey, region, endpoint, provider, and bucket fields from destination.testConnection into an rclone ls command executed through child_process.exec. The `withPermission("destination", "create")` path permits a low-privileged organization member to reach the mutation, close a quoted argument with a crafted field, and execute arbitrary commands in the root Dokploy container, which has access to the host Docker socket. This issue is fixed in version 0.29.13.

Affected products (as reported)

Vendor	Product	Versions
Dokploy	dokploy	< 0.29.13

Weakness: CWE-78, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/Dokploy/dokploy/security/advisories/GHSA-f6x8-vfwh-8hjr x_refsource_CONFIRM
https://github.com/Dokploy/dokploy/pull/4873 x_refsource_MISC
https://github.com/Dokploy/dokploy/commit/eeb6e7b8ea88e4b4b1fac8460755464100516ac9 x_refsource_MISC
https://github.com/Dokploy/dokploy/releases/tag/v0.29.13 x_refsource_MISC