Arbitrary Command Execution in Dokploy PaaS

CVE-2026-72868

What is CVE-2026-72868?

Dokploy, a self-hostable Platform as a Service (PaaS), contains a vulnerability prior to version 0.29.13, which allows low-privileged users to execute arbitrary commands within the root container by manipulating input fields in the destination connection settings. The vulnerability arises from the interpolation of sensitive fields, such as accessKey and secretAccessKey, into an rclone command executed via child_process.exec. If exploited, this could compromise the host's Docker socket, leading to severe security risks.

References