OS Command Injection Vulnerability in Dokploy by Dokploy Inc.

CVE-2026-129433

What is CVE-2026-129433?

Dokploy versions before 0.31.1 are susceptible to an OS command injection vulnerability that affects the getComposeContainerCommand() method. This flaw allows authenticated users within an organization to insert shell metacharacters into the serviceName parameter while utilizing backup.create or backup.update tRPC methods. When these commands are executed during scheduled backups, malicious actors can execute arbitrary commands with root privileges, leading to potential takeover of the host system via the exposed Docker socket. This vulnerability underscores the importance of sanitizing user inputs to mitigate exploitation risks.

References