CVE-2026-45629
CriticalCVSS 9.9Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
Dokploy 0.28.8 and earlier contains an authenticated OS command injection vulnerability in the /listen-deployment WebSocket endpoint. Any organization member can execute arbitrary system commands on remote servers managed by Dokploy, leading to full server compromise.
Risk Assessment
Any authenticated organization member can take over remote servers, posing a serious threat to the entire infrastructure.
Recommendation
Update Dokploy to version 0.28.9 or later which fixes this vulnerability, and restrict access to WebSockets.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, authenticated OS command injection in the /listen-deployment WebSocket endpoint allows any organization member to execute arbitrary system commands on remote servers managed by Dokploy, leading to full server compromise.