Hardcoded Credentials Vulnerability in Dokploy PaaS
CVE-2026-24840

8HIGH

Key Information:

Vendor

Dokploy

Status
Dokploy
Vendor
CVE Published:
28 January 2026

What is CVE-2026-24840?

Dokploy, a self-hostable Platform as a Service (PaaS), contains a vulnerability related to hardcoded credentials in its installation script. This issue impacts versions prior to 0.26.6, which utilize the same default database password, potentially exposing all Dokploy installations to unauthorized access. Users are encouraged to upgrade to version 0.26.6 to mitigate this risk. For further details and guidance, refer to the security advisory and the commit information.

Affected Version(s)

dokploy < 0.26.6

References

https://github.com/Dokploy/dokploy/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/Dokploy/dokploy/commit/b902c160a256ad3...
x_refsource_MISC

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.