CVE-2026-72740

Executive Summary

CVE-2026-72740 is a critical OS command injection vulnerability in Dokploy, a self-hostable Platform-as-a-Service (PaaS) product, affecting all versions prior to 0.29.13. An authenticated attacker with service deployment permissions and an attached SSH key can achieve remote code execution on the Dokploy host by supplying a crafted customGitUrl value that is improperly interpolated into an ssh-keyscan command. With a CVSS score of 9.9 and network-based attack vector requiring only low-privilege authentication, this vulnerability poses an extreme risk to any organization self-hosting Dokploy, potentially leading to full host compromise, lateral movement, and supply-chain style attacks against deployed applications.

Technical Analysis

The vulnerability resides in the Git provider integration of Dokploy, specifically within the file packages/server/src/utils/providers/git.ts. The vulnerable code path processes a user-controlled parameter called customGitUrl, which allows authenticated users to specify a custom Git repository URL for service deployment.

The flaw manifests through an insecure two-step process:

1. Sanitization Bypass: The user-supplied customGitUrl is passed through a function called sanitizeRepoPathSSH. While this function is intended to sanitize the repository path component of the URL, it does not adequately validate or sanitize the domain portion of the provided URL.

2. Unquoted Command Interpolation: Following sanitization, the domain extracted from customGitUrl is directly interpolated into a shell command string generated by addHostToKnownHostsCommand. This command executes ssh-keyscan against the specified host to add the host's SSH key to the known hosts file. The interpolated domain value is not wrapped in shell quoting, creating a classic OS command injection primitive.

The attack mechanism is fundamentally a command injection (CWE-78) where untrusted user input flows into a system-level shell command without proper escaping. Since the value is placed directly into the command string without quotes, an attacker can inject shell metacharacters such as ;, |, &&, or backticks to terminate the intended ssh-keyscan invocation and execute arbitrary commands.

Preconditions for exploitation:

• Authenticated access to the Dokploy instance (any account with service deployment capability)
• Attachment of an SSH key to the user's account or project
• Ability to create or modify a service that uses a custom Git URL

The vulnerability is present in the server-side code executed during the deployment pipeline. This means the injected commands run with the privileges of the Dokploy server process, which typically runs with elevated permissions to manage containers, Docker builds, and deployment infrastructure.

Exploitation Scenarios

The attack chain for CVE-2026-72740 is inferred from the vulnerability class (OS command injection) and the NVD description. No public PoC is available; the following scenario is derived from the described vulnerability mechanics.

Step 1: Reconnaissance and Target Identification

An attacker identifies a target Dokploy instance—typically reachable on ports 80/443 (web UI) and potentially 3000 (default development port). Dokploy instances are discoverable via internet-wide scanning (e.g., Shodan query title:"Dokploy"). The attacker fingerprints the instance and confirms the version is below 0.29.13.

Step 2: Authentication and Permission Fulfillment

The attacker needs valid credentials. This could be achieved through:

• Weak/default credential brute-forcing
• Credential stuffing using prior breach data
• Social engineering of legitimate users
• Compromising a low-privilege account that has deployment permissions

Step 3: Triggering the Vulnerability

With an account that has service deployment permissions and an attached SSH key:

1. The attacker navigates to the service creation/modification interface.
2. In the Git repository URL field (customGitUrl), the attacker supplies a crafted URL where the domain portion contains shell injection payloads.
3. Example payload structure (conceptual): git@<domain_with_injection>:/repo.git where the domain portion includes shell metacharacters and arbitrary commands.
4. When deployment is initiated, the server calls sanitizeRepoPathSSH on the input (which fails to block the injection), then constructs the ssh-keyscan command by interpolating the malicious domain without quotes.
5. The injected shell commands execute in the context of the Dokploy server process.

Step 4: Post-Exploitation Impact

Successful exploitation grants the attacker arbitrary command execution on the Dokploy host. This enables:

• Data exfiltration: Reading environment variables, database credentials, Docker secrets, and other sensitive configuration
• Persistence: Installing backdoors, creating new SSH keys, or establishing cron-based persistence
• Lateral movement: Pivoting to connected systems, including Docker containers, connected CI/CD systems, and cloud provider APIs
• Supply-chain compromise: Modifying source code artifacts or deployment pipelines to inject malicious code into applications deployed via Dokploy
• Ransomware deployment: Encrypting the Dokploy host and connected volumes

The attack is rated with a 9.9 CVSS score, reflecting network-based exploitation, low privilege requirements, no user interaction, and severe confidentiality, integrity, and availability impact with scope change (the compromise extends beyond the vulnerable component to the broader infrastructure).

Impact Assessment

Business Impact: This vulnerability exposes Dokploy hosting environments to complete compromise. Since Dokploy is a PaaS platform, organizations rely on it to run their production applications, databases, and services. A successful exploitation grants an attacker the same level of access as the Dokploy server process, which typically has permission to:

• Read and write all deployment configuration files
• Access connected Git repositories and credentials
• Control Docker containers and Docker Compose services
• Access cloud provider API keys (AWS, GCP, Azure) if configured for deployments
• Read environment variables containing secrets for all deployed services

CVSS Breakdown (Score 9.9, Critical):

• Attack Vector: Network (AV:N) — Exploitable remotely over the network without physical access
• Attack Complexity: Low (AC:L) — No special conditions or race conditions required
• Privileges Required: Low (PR:L) — Only requires an authenticated account with deployment permission
• User Interaction: None (UI:N) — No victim interaction needed
• Scope: Changed (S:C) — The compromise extends beyond the affected component (command injection) to the entire host system
• Confidentiality/Integrity/Availability: High/High/High (C:H/I:H/A:H) — Complete compromise of all three security pillars

Blast Radius:

• Immediate: The Dokploy host server and all processes running under its service account
• Expanded: All Docker containers and services managed by Dokploy
• Extended: Any cloud infrastructure with configured credentials, connected CI/CD pipelines, and downstream application users

Affected Systems: All Dokploy instances running versions prior to 0.29.13. This includes production deployments, staging environments, and development instances accessible to multiple users.

Detection Guidance

Sigma Rule

title: Dokploy Custom Git URL Command Injection Attempt
id: 277e8e9d-8fb0-4892-9e2b-3f8a7c2e4d61
status: experimental
description: Detects suspicious customGitUrl values containing shell metacharacters in Dokploy deployment requests
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-72740
author: Valtersit Threat Intelligence
date: 2026/01/15
tags:
    - attack.execution
    - attack.t1203
    - cve.2026-72740
logsource:
    product: dokploy
    service: server
detection:
    selection_request:
        cefCustomUrl|contains:
            - ';'
            - '|'
            - '&&'
            - '||'
            - '`'
            - '$(('
            - '${'
    selection_url_pattern:
        cefCustomUrl|re: '(git@|https?:\/\/)[^\s;|&`$]+[;|&`$]'
    condition: selection_request and selection_url_pattern
    timeframe: 5m
level: critical
falsepositives:
    - Legitimate users using unusual characters in repository names (rare)

YARA Rule

rule dokploy_cve_2026_72740_command_injection {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects customGitUrl payloads targeting CVE-2026-72740 in Dokploy"
        cve = "CVE-2026-72740"
        date = "2026-01-15"
        severity = "critical"
    strings:
        $url_key = "customGitUrl" ascii wide nocase
        $git_pattern = "git@" ascii wide nocase
        $ssh_keyscan = "ssh-keyscan" ascii wide nocase
        $injection_semicolon = ";" ascii wide
        $injection_pipe = "|" ascii wide
        $injection_amp = "&&" ascii wide
        $injection_dollar = "$(" ascii wide
        $injection_backtick = "`" ascii wide
        $injection_brace = "${" ascii wide
    condition:
        $url_key and $git_pattern and
        (1 of ($injection_*)) and
        filesize < 10MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"DOKPLOY CVE-2026-72740 Command Injection Attempt"; flow:established,to_server; content:"customGitUrl"; http_client_body; nocase; content:"git@"; http_client_body; nocase; pcre:"/customGitUrl[^&\r\n]*(;|\||&&|\|\||`|\$\()/i"; classtype:attempted-admin; sid:2026727401; rev:1; reference:cve,2026-72740; priority:1;)

Elastic Detection

// EQL query for Elasticsearch - detect suspicious customGitUrl HTTP requests
sequence by source.ip
  [network where
    network.protocol == "http" and
    http.request.body.text contains "customGitUrl" and
    (http.request.body.text regex~ ".*customGitUrl.*(;|\\|\\||&&|\\$\\()|`).*" or
     http.request.body.text regex~ ".*customGitUrl.*git@.*[;|&`].*")
  ]
  [process where
    event.type == "start" and
    process.name == "ssh-keyscan" and
    process.command_line regex~ ".*[;|&`].*"
  ]

Splunk SPL Query

index=proxy OR index=server_logs
| search "customGitUrl"
| regex _raw="customGitUrl[^&\"]*(;|\||&&|\|\||`|\$\()"
| rex field=_raw "customGitUrl=(?<git_url>[^&\s]+)"
| eval suspicious_chars = case(
      match(git_url, ";") OR match(git_url, "\|") OR 
      match(git_url, "&&") OR match(git_url, "`") OR 
      match(git_url, "\$\("), "yes", 1=1, "no")
| where suspicious_chars == "yes"
| table _time, src_ip, user, git_url, dest_port
| sort - _time

Wazuh OSSEC Rule

<group name="dokploy,">
  <rule id="654004" level="15" frequency="5" timeframe="60">
    <if_sid>510, 515</if_sid>
    <match>customGitUrl</match>
    <regex>(?i)customGitUrl.*(;|\||&&|\|\||`|\$\()</regex>
    <description>Dokploy CVE-2026-72740: Command injection attempt detected in customGitUrl parameter</description>
    <group>attack.execution,cve.2026-72740,</group>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>

  <rule id="654005" level="12">
    <if_sid>2027401</if_sid>
    <match>ssh-keyscan</match>
    <description>Dokploy CVE-2026-72740: ssh-keyscan executed with injection payload</description>
    <group>attack.execution,cve.2026-72740,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — While the NVD description indicates the issue is "fixed in version 0.29.13," no patch evidence exists from currently tracked sources to independently confirm availability. Organizations must verify patch availability directly with the vendor.

1. Immediate Mitigations (No Patch Available)

• Restrict Authenticated Access: Immediately reduce the number of accounts with service deployment permissions. Require managerial approval for any new account with deployment capabilities.
• Disable Custom Git URL Feature: If possible within the Dokploy configuration, disable or restrict the ability to specify custom Git repository URLs. Fall back to predefined repository configurations.
• Network Segmentation: Place the Dokploy host behind a firewall with strict access control lists. Restrict administrative UI access to internal network segments or VPN-required access.
• Monitor Authentication Logs: Increase monitoring on login attempts and deployment activities. Flag any unusual patterns, especially deployment attempts using custom Git URLs.
• SSH Key Review: Audit all attached SSH keys and their assignment. Remove any unused or orphaned SSH keys.
• Disable ssh-keyscan Functionality: Temporarily patch the running server to comment out the addHostToKnownHostsCommand invocation until the official fix is applied.

2. Patch/Upgrade Steps

• Check for Version 0.29.13: Verify with the vendor whether version 0.29.13 (or later) is available from official distribution channels.
• Upgrade Procedure: If available, upgrade all Dokploy instances to version 0.29.13 or later from the official repository:

  # Backup configuration and data first
  # Follow official Dokploy upgrade documentation
  # Verify version post-upgrade
  

• Verify Fix: After upgrading, test that the customGitUrl parameter properly rejects shell metacharacters and that ssh-keyscan commands always terminate when receiving malformed input.
• Monitor Vendor Channels: Subscribe to Dokploy security advisories and GitHub release notifications for the official fix confirmation.

3. Long-Term Hardening

• Principle of Least Privilege: Implement role-based access control, ensuring only essential personnel have deployment permissions. Separate roles for service creation, deployment, and administration.
• Input Validation Framework: Advocate for and implement server-side input validation that uses an allow-list approach for Git URL formats, rather than block-lists.
• Container Isolation: Run the Dokploy server in a container with restricted capabilities (no --privileged mode) and read-only root filesystem where possible.
• Secret Management: Store all deployment credentials in a dedicated secrets manager (e.g., HashiCorp Vault) rather than environment variables accessible to the server process.
• Regular Security Audits: Perform periodic code review of all custom-provider integrations, with a specific focus on shell command construction.
• Runtime Monitoring: Deploy runtime security tools (e.g., Falco, auditd) to detect and alert on unexpected process executions from the Dokploy server, particularly around deployment events.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72740
2. Dokploy Official Repository: https://github.com/Dokploy/dokploy — Version tracking and release notes for 0.29.13 fix
3. CWE-78 Documentation: https://cwe.mitre.org/data/definitions/78.html — Improper Neutralization of Special Elements used in an OS Command
4. MITRE ATT&CK — T1203: https://attack.mitre.org/techniques/T1203/ — Exploitation for Client Execution
5. First.org EPSS: https://www.first.org/epss/ — API to check for EPSS scoring once available

Threat Actor Campaigns: No known campaign or in-the-wild exploitation evidence for CVE-2026-72740 at the time of this writing. CISA KEV listing: NO. The vulnerability was disclosed through coordinated responsible disclosure channels. Organizations should treat this as a high-priority unpatched risk and monitor vendor communications for the official fix release and any exploit activity disclosures.