CVE-2026-45791

Executive Summary

CVE-2026-45791 describes a critical session management vulnerability in Dokploy, a self-hostable Platform as a Service (PaaS), affecting versions prior to 0.29.6. This flaw allows a previously compromised session token, specifically better-auth.session_token, to remain valid for an extended period of up to three days even after the legitimate user changes their account password. This enables threat actors to maintain unauthorized access to affected Dokploy instances, leading to potential high confidentiality impacts.

Technical Analysis

The vulnerability, classified as CWE-613 (Insufficient Session Expiration), arises from an improper session invalidation mechanism within Dokploy's user account management. Specifically, the user.update procedure, located in the apps/dokploy/server/api/routers/user.ts file, is responsible for handling user profile updates, including password changes. When a user updates their account.password, the procedure fails to adequately terminate or invalidate all associated active sessions stored in the session table or storage mechanism.

Consequently, if a better-auth.session_token has been compromised prior to a legitimate user's password change, that specific compromised session token remains valid and active. The NVD description specifies that such a session can persist for up to three days post-password change. This prolonged validity period provides a significant window for an attacker to continue accessing the Dokploy instance with the compromised session, even after the legitimate user believes their account has been secured through a password update.

The core of the issue is the incomplete revocation of session identifiers (specifically better-auth.session_token) upon a security-sensitive event like a password reset. A robust session management system should ensure that all existing sessions, or at least those associated with the account undergoing a password change, are immediately invalidated to prevent unauthorized persistence. The current implementation allows for a disconnect between the security state of the user's password and the active state of their sessions, making it a critical security flaw.

Exploitation Scenarios

Exploitation of CVE-2026-45791 relies on an attacker having already compromised a user's session token prior to the legitimate user initiating a password change. The vulnerability does not provide an initial access vector but facilitates persistence of unauthorized access.

1. Reconnaissance/Target Identification: An attacker identifies Dokploy instances, potentially through Shodan dorks or other scanning techniques. They then target specific users within these instances, aiming to compromise their better-auth.session_token.
2. Initial Session Compromise (Pre-condition): This vulnerability requires a pre-existing compromised session. Methods for initial compromise are outside the scope of this CVE but could include credential stuffing, phishing, brute-force attacks, cross-site scripting (XSS) leading to cookie theft, or other means of session hijacking. The attacker successfully obtains a better-auth.session_token for a target user.
3. Flaw Triggering: The legitimate user, unaware of the session compromise, decides to change their password via the Dokploy user interface. This action triggers the user.update procedure within the apps/dokploy/server/api/routers/user.ts endpoint, which updates the account.password field. Crucially, the Dokploy application fails to delete or invalidate the attacker's already compromised session from the session storage.
4. Payload/Execution Method (Persistence): No active "payload" or execution method is required at this stage. The vulnerability's mechanism is passive: the compromised better-auth.session_token simply continues to function. The attacker, possessing this token, maintains their authenticated session with the Dokploy instance, even though the legitimate user's password has been changed. The NVD specifies this persistence can last for up to three days.
5. Post-Exploitation Impact: With continued unauthorized access, the attacker can perform actions within the Dokploy PaaS environment with the privileges of the compromised account. This includes accessing sensitive data, deploying malicious applications, modifying existing configurations, or potentially escalating privileges within the PaaS environment. The primary impact is a loss of confidentiality (CVSS C:H) and potentially integrity.

It is important to note that no public Proof-of-Concept (PoC) or exploit code is known for this specific CVE. The attack chain is inferred directly from the vulnerability description, highlighting the persistence mechanism rather than the initial compromise. The attack complexity (AC:H) indicated in the CVSS vector likely reflects the difficulty associated with the initial session compromise.

Impact Assessment

The impact of CVE-2026-45791 is primarily centered on confidentiality and, by extension, the integrity of data and operations within the Dokploy PaaS. The CVSS 3.1 score of 5.9 (Medium severity) with a vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N provides a detailed breakdown of this impact:

• Attack Vector (AV:N) - Network: The vulnerability can be exploited remotely over a network, without requiring local access to the Dokploy server. This broadens the potential attack surface significantly.
• Attack Complexity (AC:H) - High: This indicates that certain conditions beyond the attacker's control must exist for exploitation. In this case, it implies that the attacker must first successfully compromise an active session token, which can be a complex endeavor, before this specific vulnerability (session persistence) can be leveraged. This aspect refers to the pre-requisite, not the act of maintaining the session itself.
• Privileges Required (PR:N) - None: Once the session is compromised, the attacker does not need any additional privileges to exploit the session persistence flaw. They simply continue to use the existing, valid session.
• User Interaction (UI:N) - None: No interaction from the legitimate user is required for the attacker to maintain their persistent session once the password change has occurred.
• Scope (S:U) - Unchanged: The vulnerability does not allow an attacker to breach security boundaries or impact resources beyond the scope of the affected Dokploy instance or the compromised user's privileges.
• Confidentiality Impact (C:H) - High: This is the most significant impact category. An attacker maintaining a persistent session can access all data and resources that the compromised user account has privileges for. In a PaaS environment like Dokploy, this could include source code repositories, databases, deployed applications' runtime environments, sensitive configuration files, and potentially other tenant data, leading to a substantial breach of sensitive information.
• Integrity Impact (I:N) - None: The vulnerability itself does not directly lead to unauthorized modification of data. However, the prolonged unauthorized access (C:H) inherently enables an attacker to perform integrity-impacting actions if the compromised account has those permissions.
• Availability Impact (A:N) - None: The vulnerability does not directly impact the availability of the Dokploy service.

The blast radius extends to all resources accessible by the compromised user account within the Dokploy PaaS. For enterprise users, this could mean unauthorized access to critical development and production environments, intellectual property, customer data, and internal systems, posing significant operational and reputational risks. The persistence for up to three days offers a substantial window for attackers to exfiltrate data or establish further footholds.

Detection Guidance

Detecting exploitation of CVE-2026-45791 is challenging because it involves the persistence of an already compromised session rather than a distinct attack signature. Effective detection relies on advanced log correlation, behavioral analytics, and comprehensive monitoring of user and session activities within the Dokploy PaaS environment. The following rules are conceptual and would require adaptation to specific Dokploy logging mechanisms and infrastructure.

Sigma Rule

A Sigma rule for this vulnerability would focus on identifying anomalous session activity after a password change event. This often requires correlating multiple log sources.

title: Dokploy Persistent Session After Password Change (CVE-2026-45791)
id: 5414e214-e5e7-4f6c-8a21-3a05d6e2a22a
status: experimental
description: Detects continued activity from a previously active session after a user's password has been changed, indicative of CVE-2026-45791 exploitation. Requires correlation of password change events with session activity.
author: valtersit.com
date: 2024/07/30
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-45791
logsource:
    category: webserver # Or application_logs if Dokploy has dedicated application logs
    product: dokploy
detection:
    # Stage 1: Identify a successful password change event
    password_change:
        event.action: "user.update"
        user.account.password_changed: "true" # Hypothetical field
        status: "success"
        api.endpoint: "*api/routers/user.ts" # Hypothetical field for API endpoint
        # Consider adding user.id or target.user.id to correlate
    
    # Stage 2: Identify continued session activity from the *same* session token (or source IP)
    # after the password change, especially if originating from an unusual location.
    # This requires stateful correlation in a SIEM.
    continued_session_activity:
        event.action: "*" # Any authenticated action
        session.token: "*" # Requires logging of session tokens or session IDs
        # Correlate session.token from password_change to continued_session_activity
        # Optional: source.ip != previous_known_legitimate_ip OR geoip.country != legitimate_country
        # event.timestamp > password_change.timestamp AND event.timestamp < (password_change.timestamp + 3 days)
    
    # Example fields, adjust to actual log schemas
    condition: password_change | where count(continued_session_activity) by user.id, session.token > 0
    # Note: A direct Sigma rule cannot fully implement this correlation without SIEM capabilities.
    # This rule acts as a high-level conceptual framework for SIEM-based detection.
level: high

YARA Rule

YARA rules are designed for static file analysis to identify patterns in binaries or documents. This vulnerability is a logical flaw in session management within an application's runtime behavior, not a signature in a file or process that YARA can scan. Therefore, a YARA rule is not applicable for direct detection of CVE-2026-45791 exploitation. It may be theoretically possible to craft YARA rules to detect vulnerable source code files (e.g., looking for specific code patterns in apps/dokploy/server/api/routers/user.ts related to session handling), but this is not a runtime detection for exploitation.

Suricata IDS Rule

A Suricata rule would attempt to detect network traffic patterns indicative of the user.update endpoint being accessed, followed by continued suspicious session activity. However, detecting the persistence of a session purely at the network layer, especially for an application-level flaw, is extremely difficult without deep packet inspection of encrypted traffic and stateful analysis.

# This rule is highly generalized and may produce false positives.
# It attempts to identify POST requests to the Dokploy user update API endpoint.
# Actual exploitation detection would require correlation of IP/session IDs
# and deep application-level context, which is beyond a simple Suricata rule.

# Rule to detect POST requests to the user update endpoint
alert http any any -> any any (msg:"ET_INFO Dokploy user.update API access (CVE-2026-45791 context)"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/api/routers/user.ts"; nocase; pcre:"/user\.update/U"; sid:20264579101; rev:1; metadata:impact_flag,low,tag,CVE_2026_45791;)

# Note: This rule only detects access to the endpoint. It does NOT detect the
# actual session persistence flaw or its exploitation. Detecting continued
# session validity would require stateful logging and correlation at the SIEM layer.
# It would also struggle with HTTPS traffic unless SSL/TLS decryption is in place.

Elastic Detection

An Elastic EQL (Event Query Language) rule provides more powerful temporal correlation capabilities within an Elastic Stack environment. This rule would look for a user password change event followed by subsequent authenticated actions from the same (potentially compromised) session token or from the same source IP/user agent within the vulnerable persistence window.

{
  "query": {
    "bool": {
      "must": [
        {
          "sequence": {
            "first": {
              "query": {
                "bool": {
                  "must": [
                    { "match": { "event.action": "user.update" } },
                    { "match": { "api.endpoint": "*api/routers/user.ts" } },
                    { "match": { "status": "success" } }
                  ]
                }
              }
            },
            "then": [
              {
                "query": {
                  "bool": {
                    "must": [
                      { "match": { "event.category": "authentication" } },
                      { "range": { "@timestamp": { "gte": "now-3d/d" } } }
                      // Additional filters for 'session.id' or 'source.ip' matching the 'first' event
                      // e.g., { "term": { "session.id": "{{first.session.id}}" } }
                      // Note: EQL 'join' or 'by' conditions are needed for full correlation
                    ]
                  }
                }
              }
            ],
            "maxspan": "3d"
          }
        }
      ]
    }
  },
  "join": {
    "field": "user.id",
    "query": {
      "bool": {
        "must": [
          // Correlate on the user ID and potentially the session ID or source IP if logged
          // Example: Join on user.id and then check if subsequent events
          // originate from a different or "suspicious" source.ip for that user's session.
        ]
      }
    }
  },
  "trigger": {
    "action": [ "email", "jira" ]
  },
  "name": "Dokploy Persistent Session After Password Change (CVE-2026-45791)",
  "description": "Detects anomalous continued session activity after a user password change in Dokploy.",
  "risk_score": 73,
  "severity": "high"
}

Note: This EQL rule is highly conceptual due to the lack of specific log field examples for Dokploy. Actual implementation would require detailed knowledge of Dokploy's logging schema, especially how user.update events are logged and how session IDs or tokens are tracked across subsequent actions.

Splunk SPL Query

A Splunk SPL query can perform correlation over time to identify this anomaly. It would search for password change events and then look for subsequent activity from the same user/session token where the session should ideally have been invalidated.

# Search for Dokploy application logs
index="dokploy_app_logs" OR sourcetype="dokploy:access"
| eval _time=strptime(timestamp_field, "%Y-%m-%dT%H:%M:%S%Z") # Adjust timestamp_field to your log's timestamp
| transaction user_id_field startswith="action=user.update status=success" endswith="action=logout OR action=session_expire" maxspan=3d keepevicted=true
| where NOT (eventtype="password_change_related_session_invalidation") # Look for lack of invalidation
| search (action="user.update" AND status="success")
| join type=left user_id_field [search index="dokploy_app_logs" (action!="user.update" AND action!="login_success") earliest=-3d latest=now
    | stats count as session_activity_count by user_id_field, session_token_field, client_ip_field ]
| where isnotnull(session_activity_count) AND _time < (password_change_time + 3*24*60*60) AND session_token_field != "newly_generated_session_token_after_password_change"
| table _time, user_id_field, client_ip_field, session_token_field, action, password_change_time, session_activity_count
| rename user_id_field as "User ID", client_ip_field as "Client IP", session_token_field as "Session Token"
| sort -_time

Note: This Splunk SPL query is highly generalized. user_id_field, session_token_field, client_ip_field, timestamp_field, and action must be replaced with actual field names from your Dokploy logs. Effective detection requires Dokploy to log session tokens or IDs explicitly, as well as clear indicators for password changes and session invalidations.

Wazuh OSSEC Rule

Wazuh, being primarily a host-based intrusion detection system, would have difficulty detecting this network-centric application logic flaw directly unless Dokploy writes very specific logs to the filesystem that Wazuh can monitor. A realistic Wazuh rule would monitor for general anomalous activity around user updates or authentication failures that might precede a session compromise, or monitor specific log files for messages indicating a password change without corresponding session cleanup.

<group name="dokploy,authentication,session_management,">
  <!-- Rule to identify potential Dokploy user update actions (requires specific log pattern) -->
  <rule id="100001" level="4">
    <if_sid>50000 OR 50001</if_sid> <!-- Assuming generic web server access or API access rules exist -->
    <field name="url" type="pcre">apps/dokploy/server/api/routers/user.ts</field>
    <field name="method">POST</field>
    <description>Dokploy user.update API access detected.</description>
    <group>access_to_user_update,</group>
  </rule>

  <!-- Rule to correlate user update with lack of session invalidation (highly conceptual) -->
  <rule id="100002" level="9" frequency="1" timeframe="3600" timeout="86400">
    <if_matched_sid>100001</if_matched_sid>
    <field name="user"></field> <!-- Assumes user ID is logged -->
    <field name="session_token"></field> <!-- Assumes session token is logged -->
    <list field="user" lookup="not_in_list">dokploy_session_invalidated_users</list>
    <description>CVE-2026-45791: Dokploy session potentially persistent after password change for user: $(user).</description>
    <group>session_persistence,cve_2026_45791,high_impact,</group>
  </rule>

  <!-- This requires a complementary mechanism or another rule/external script to populate
       the 'dokploy_session_invalidated_users' list based on actual session invalidation events.
       Wazuh's default capabilities for such complex stateful correlation might be limited
       without extensive custom scripting or integration with a SIEM. -->
</group>

Note: These Wazuh rules are very generic and require specific Dokploy log formats to be effective. Rule 100002 is highly conceptual and would need advanced correlation logic that might be better handled by a SIEM or custom scripts integrating with Wazuh alerts.

Mitigation & Patch Guidance

Given that CVE-2026-45791 affects Dokploy versions prior to 0.29.6 and the patch confidence is "UNPATCHED" (meaning no evidence from tracked sources, but the vendor has released a fix), immediate action is required for affected deployments.

1. Immediate Mitigations (Workarounds - N/A from data):

   • Forced Session Invalidation: As a highly recommended immediate action, administrators should implement a mechanism to forcefully log out all active user sessions for the entire Dokploy instance after any critical security event, such as a known or suspected compromise, or even as a periodic measure. This is a manual workaround for the lack of automatic session invalidation.
   • Password Rotation: Mandate all users to immediately change their passwords, and concurrently, ensure all sessions are forcefully invalidated after each password change. This is critical to revoke any existing compromised sessions.
   • Strict Session Timeouts: Implement the shortest feasible session timeout periods to reduce the window of opportunity for an attacker using a persistent session.
   • Multi-Factor Authentication (MFA): Enforce MFA for all Dokploy user accounts. While MFA doesn't directly prevent a compromised session token from remaining valid, it significantly raises the bar for initial session compromise and subsequent re-authentication attempts.
   • Network Segmentation & Access Control: Restrict network access to the Dokploy PaaS administrative interfaces and sensitive data to only authorized personnel and trusted networks.
   • Monitor for Anomalous Activity: Implement robust logging and monitoring for unusual access patterns, such as login from new or suspicious IP addresses, access outside business hours, or unexpected resource usage, especially for administrator accounts.

2. Patch/Upgrade Steps:

   • Upgrade to Version 0.29.6 or Later: The vendor has addressed this vulnerability in Dokploy version 0.29.6. Administrators should upgrade their Dokploy instances to this version or any subsequent releases as soon as possible. Consult the official Dokploy documentation or release notes for detailed upgrade instructions.
   • Verify Patch Application: After upgrading, confirm that the Dokploy instance is running version 0.29.6 or newer. Test the password change functionality to ensure that all previous sessions are properly invalidated upon a password update.

3. Long-Term Hardening:

   • Review Session Management: Conduct regular security audits of Dokploy's session management configurations. Ensure that session tokens are securely generated, stored, and properly invalidated upon logout, password change, or prolonged inactivity.
   • Principle of Least Privilege: Ensure that users and applications within Dokploy operate with the minimum necessary permissions required to perform their functions.
   • Regular Security Audits: Perform regular security assessments, penetration tests, and code reviews of custom Dokploy deployments and extensions to identify and mitigate similar logical flaws proactively.
   • Comprehensive Logging: Enhance logging for all security-relevant events, including authentication attempts, session creations, session invalidations, password changes, and administrative actions. Ensure logs are securely stored and monitored.

References

• National Vulnerability Database (NVD) - CVE-2026-45791:
  • https://nvd.nist.gov/vuln/detail/CVE-2026-45791
• Dokploy GitHub Releases (for version 0.29.6):
  • Direct link to release 0.29.6 would be ideal, but requires finding the official Dokploy repository. A general link to their releases is provided.
  • https://github.com/dokploy/dokploy/releases (Hypothetical, based on NVD's mention of Dokploy)
• CWE-613: Insufficient Session Expiration:
  • https://cwe.mitre.org/data/definitions/613.html
• MITRE ATT&CK T1078 - Valid Accounts:
  • https://attack.mitre.org/tactics/T1078/

Note: No known threat actor campaigns or exploits-in-the-wild evidence are currently available for CVE-2026-45791 beyond the NVD description.