CVE-2026-72902
CriticalCVSS 9.9Summary
Dokploy prior to version 0.29.13 allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById interpolate the password field into an execAsyncRemote shell command instead of using safeDockerLoginCommand.
Risk Assessment
Risk of remote code execution on target servers, potentially leading to full infrastructure compromise.
Recommendation
Update Dokploy to version 0.29.13 or later. Restrict access to registry testing functions and monitor their usage.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts interpolate the password field into an execAsyncRemote shell command instead of using safeDockerLoginCommand. This issue is fixed in version 0.29.13.