CVE-2026-72868

Executive Summary

CVE-2026-72868 is a critical OS command injection vulnerability (CWE-78) in Dokploy, a free, self-hostable Platform as a Service (PaaS) solution, affecting all versions prior to 0.29.13. The flaw exists in the destination connection testing feature, where user-controlled fields are interpolated into an rclone ls command executed via child_process.exec without proper sanitization. A low-privileged organization member can exploit this to achieve arbitrary command execution in the root Dokploy container, which has access to the host Docker socket, resulting in full host compromise. The vulnerability carries a CVSS score of 9.9, indicating critical severity with high impact on confidentiality, integrity, and availability.

Technical Analysis

The vulnerability resides in the apps/dokploy/server/api/routers/destination.ts file, which handles destination connection testing within the Dokploy application. Specifically, the destination.testConnection mutation interpolates the following fields directly into an rclone ls command executed through child_process.exec:

• accessKey
• secretAccessKey
• region
• endpoint
• provider
• bucket

The application uses Node.js's child_process.exec, which spawns a shell (/bin/sh on Unix systems) to execute the constructed command string. Because the user-controlled fields are embedded into the shell command without adequate escaping or sanitization, an attacker can inject shell metacharacters to break out of the intended command structure and execute arbitrary system commands.

The vulnerability is reachable through the withPermission("destination", "create") authorization path, which permits any low-privileged organization member to invoke the mutation. The authorization model fails to restrict access to this dangerous operation, allowing any authenticated user with minimal privileges to trigger the vulnerable code path.

The execution context is particularly dangerous: the injected commands run inside the root Dokploy container, which has access to the host Docker socket (/var/run/docker.sock). This means an attacker who achieves command execution in the container can issue Docker API calls to the host daemon, effectively gaining root-level control over the entire host machine.

The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The attack vector is network-based (AV:N), requires low attack complexity (AC:L), requires low privileges (PR:L), requires no user interaction (UI:N), and has a scope change (S:C) — meaning the compromise extends beyond the vulnerable component to impact the host operating system and all co-resident containers and services.

Exploitation Scenarios

Reconnaissance and Target Identification: Attackers typically begin by scanning the internet for publicly exposed Dokploy instances. Dokploy deployments are identifiable via their distinctive web login interface, default ports (primarily 3000), and application-specific response headers. Shodan queries such as "Dokploy" or "dokploy app" can identify exposed instances. Once identified, the attacker must establish an authenticated session as any organization member, which may be achieved through self-registration (if enabled), or through credential stuffing or weak password attacks against known employee credentials.

Triggering the Vulnerability: The attack chain relies on reaching the destination.testConnection mutation in the GraphQL API. After authentication, the attacker crafts a GraphQL mutation request targeting this endpoint. The attacker supplies values for the accessKey, secretAccessKey, region, endpoint, provider, or bucket fields designed to break out of the quoted argument context in the generated rclone ls command.

Payload Execution: The attacker crafts one of the aforementioned fields to contain a closing quote followed by shell metacharacters and an arbitrary command. For example, a payload structured as "fieldvalue"; <malicious command>;# would terminate the string literal, inject a semicolon to chain commands, append the malicious payload, and use the # or ; to comment out or truncate the remainder of the command. Since child_process.exec invokes a shell, standard shell features such as command substitution, pipe chaining, environment variable access, and output redirection are all available to the attacker.

Post-Exploitation Impact: Commands execute in the root Dokploy container. Given the container's access to the host Docker socket, the attacker can:

1. List all running containers via the Docker API (docker ps)
2. Read host filesystem mounts accessible to the container
3. Deploy a malicious container with privileged flags and host filesystem mounts, achieving root code execution on the host operating system
4. Exfiltrate secrets, credentials, environment variables, and Docker configuration data
5. Ransomware or encrypt host filesystems
6. Establish persistent backdoors via host cron jobs or containerized services

No public PoC is available at the time of writing; this attack chain is inferred from the vulnerability class (OS command injection via interpolated shell command) and the NVD description.

Impact Assessment

CVSS Breakdown: The vulnerability scores 9.9 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The network attack vector, low complexity, and low privilege requirement combine to make this vulnerability highly accessible to attackers. The scope change (S:C) is the most consequential element — the resource impacted extends beyond the vulnerable application to the underlying host infrastructure.

Business Impact: Dokploy is a self-hosted PaaS used by organizations to deploy and manage applications and services. A successful exploit results in:

• Confidentiality loss (High): Full read access to the host filesystem, Docker secrets, environment variables, application code, and database credentials.
• Integrity loss (High): Ability to modify application deployments, inject malicious code into running services, alter Docker configurations, and tamper with the host operating system.
• Availability loss (High): Complete denial of service through container destruction, host shutdown, or ransomware deployment.

Blast Radius: The blast radius extends well beyond the Dokploy application itself. Organizations using Dokploy as their central deployment platform entrust it with credentials for all connected services (cloud providers, container registries, CI/CD pipelines, databases). A compromise of the Dokploy container with Docker socket access effectively compromises:

• All applications and services deployed via Dokploy
• The host operating system
• Any systems reachable via the host's network position
• Any credentials stored in the deployment platform

Affected Systems: All Dokploy instances running versions prior to 0.29.13. Deployments where the Docker socket is mounted into the Dokploy container (the default configuration) are at maximum risk.

Detection Guidance

Sigma Rule

title: Dokploy Destination Test Connection Command Injection
id: 3b21cbc0-7f4a-4c8e-9e2d-d61b48e4c5a2
status: experimental
description: Detects exploitation attempts of CVE-2026-72868 targeting Dokploy destination.testConnection endpoint
author: ValtersIT Threat Intelligence
date: 2026/01/15
logsource:
  category: process_creation
  product: linux
detection:
  selection_process:
    Image|endswith: '/node'
    CommandLine|contains:
      - 'rclone'
      - 'ls'
  selection_exploit_payloads:
    CommandLine|contains|all:
      - 'destination'
      - 'testConnection'
  selection_shell_metacharacters:
    CommandLine|contains:
      - ';'
      - '&&'
      - '||'
      - '`'
      - '$(('
      - ';curl'
      - ';wget'
      - ';nc '
      - ';bash -i'
      - ';python3 -c'
  condition: selection_process and selection_exploit_payloads and selection_shell_metacharacters
  timeframe: 10s
level: critical

YARA Rule

rule CVE_2026_72868_Dokploy_API_Exploit {
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects HTTP requests exploiting command injection in Dokploy destination.testConnection"
        date = "2026-01-15"
        cve = "CVE-2026-72868"
        severity = "critical"
    strings:
        $graphql_target = "destination.testConnection" ascii nocase
        $mutation_field_1 = "accessKey" ascii nocase
        $mutation_field_2 = "secretAccessKey" ascii nocase
        $mutation_field_3 = "region" ascii nocase
        $mutation_field_4 = "endpoint" ascii nocase
        $mutation_field_5 = "bucket" ascii nocase
        $mutation_field_6 = "provider" ascii nocase
        $shell_inject_1 = ";curl" ascii
        $shell_inject_2 = ";wget" ascii
        $shell_inject_3 = "$(" ascii
        $shell_inject_4 = "`" ascii
        $shell_inject_5 = "&&" ascii
        $shell_inject_6 = "|sh" ascii
        $shell_inject_7 = ";bash" ascii
        $shell_inject_8 = ";nc " ascii
        $shell_inject_9 = ";python" ascii
    condition:
        uint16(0) == 0x0A0D and
        $graphql_target and
        2 of ($mutation_field_*) and
        1 of ($shell_inject_*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-72868 - Dokploy destination.testConnection Command Injection Attempt"; flow:established,to_server; content:"destination"; http_uri; nocase; content:"testConnection"; http_uri; nocase; content:"accessKey"; http_client_body; nocase; content:"?GOOGLE"; http_client_body; pcre:"/(\x3b|\x26\x26|\x7c\x7c|\x24\x28|\x60)[^\x22]{0,200}(curl|wget|bash|nc|python|sh|id|whoami|cat|chmod)/i"; classtype:attempted-admin; reference:cve,2026-72868; sid:10072868; rev:1;)

Elastic Detection

// Detect anomalous child processes spawned by the Dokploy Node.js process
process where event.action == "exec" and 
  process.parent.name == "node" and
  process.parent.args : "*dokploy*" and
  process.args : "*rclone*" and
  (process.args : "ls" and 
   (process.args : "*;*" or 
    process.args : "*&&*" or 
    process.args : "*||*" or 
    process.args : "*`*" or 
    process.args : "*$(*"))

Splunk SPL Query

index=main sourcetype=linux:process_creation
| search parent_process=node process_command="*rclone*" AND process_command="*ls*"
| regex process_command="(;|\&\&|\|\||`|\$\(|>|<)"
| regex process_command="(curl|wget|bash|sh|nc |python|id|whoami|chmod|base64|/etc/passwd|docker)"
| table _time host user parent_process process_command
| sort - _time

Wazuh OSSEC Rule

<group name="syslog,">
  <rule id="193996" level="15">
    <if_sid>5715</if_sid>
    <match>rclone</match>
    <regex>(;|\&\&|\|\||\$\(|`)</regex>
    <regex>(curl|wget|bash|nc|python|sh|whoami|id|chmod|docker|/etc/passwd)</regex>
    <description>Possible CVE-2026-72868 Dokploy command injection exploit detected on destination.testConnection endpoint. Look for additional indicators of compromise.</description>
    <group>cve-2026-72868,command_injection,dokploy,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. The NVD description indicates a fix in version 0.29.13, but no patch artifacts, release notes, or vendor advisories have been confirmed from tracked sources at the time of this report. Organizations should validate the fix independently before assuming remediation.

Immediate Mitigations (implement these now):

1. Restrict access: If upgrading immediately is not possible, restrict all access to the Dokploy web interface and API to trusted network segments or VPN users. Use network-level access control (firewall rules) to prevent internet-facing access to port 3000.
2. Revoke unnecessary privileges: Audit organization members and remove any accounts without an operational need from the "destination create" permission path.
3. Disable destination features: If feasible through configuration, restrict or disable the destination connection testing functionality to prevent attackers from reaching the vulnerable mutation.
4. Enforce multi-factor authentication: Require MFA for all Dokploy user accounts to reduce the risk of account compromise that could reach the privilege level required for exploitation.
5. Container isolation hardening: Remove or mount the Docker socket read-only, or relocate the Dokploy container to a non-privileged environment where host Docker socket access is not available.

Patch/Upgrade Steps:

1. Upgrade Dokploy to version 0.29.13 or later as soon as the patched version has been confirmed available from the vendor.
2. Before upgrading, back up Dokploy configuration, database, and deployment manifests.
3. After upgrading, verify that apps/dokploy/server/api/routers/destination.ts no longer interpolates user input into child_process.exec calls and that fields are properly escaped or use the safe child_process.execFile alternative.
4. If using Docker Compose for Dokploy, pull the new image and recreate the containers.

Long-Term Hardening:

1. Implement a vulnerability management program that tracks CVEs for all self-hosted applications and prioritizes patching based on CVSS score and exploitability.
2. Apply the principle of least privilege to container deployments: never mount the Docker socket unless absolutely necessary, and when required, use a dedicated proxy that restricts permissible operations.
3. Deploy runtime security monitoring (e.g., Falco, Sysdig, or Wazuh) to detect anomalous shell execution from application containers.
4. Segment the Dokploy infrastructure network to limit lateral movement in the event of an incident.
5. Establish a Web Application Firewall (WAF) policy to detect and block GraphQL mutations containing shell metacharacters in string parameters.

References

1. NVD — CVE-2026-72868: https://nvd.nist.gov/vuln/detail/CVE-2026-72868 (NVD entry with official description and CVSS scoring)
2. Dokploy Official Documentation: https://dokploy.com/docs (for version history, upgrade instructions, and deployment best practices)
3. CWE-78 — Improper Neutralization of Special Elements used in an OS Command: https://cwe.mitre.org/data/definitions/78.html (vulnerability class reference)
4. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/ (technique mapping reference)
5. FIRST CP Email — EPSS: (not yet scored for this CVE at time of writing)

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence have been reported for this CVE at the time of writing. The vulnerability was not added to the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given the critical CVSS score and the relative ease of exploitation (low complexity, low privileges), active exploitation is highly likely once the vulnerability becomes widely known. Organizations running exposed Dokploy instances should treat this as a priority risk.