CVE-2026-72876

Executive Summary

CVE-2026-72876 is a critical (CVSS 9.9) operating system command injection vulnerability in Dokploy, a free, self-hostable Platform-as-a-Service (PaaS) solution. Versions prior to 0.29.13 fail to enforce cross-tenant ownership checks on several swarm-related API endpoints, allowing an authenticated attacker with only server:read permission to execute arbitrary operating system commands on another tenant's server via a command injection flaw in the getNodeInfo function. Successful exploitation results in full remote code execution as the configured SSH user, leading to complete compromise of the target server and, due to the scoped CVSS vector, the broader infrastructure to which the server is connected. The vulnerability affects all self-hosted Dokploy deployments running versions prior to 0.29.13; the fix is included in version 0.29.13.

Technical Analysis

The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command — "OS Command Injection"). The root cause is a compound flaw involving two distinct weaknesses that, when chained, enable cross-tenant remote code execution.

Component 1: Missing Authorization on Swarm API Endpoints

The NVD description identifies four endpoints within apps/dokploy/server/api/routers/swarm.ts that are affected by inadequate ownership validation:

• swarm.getNodes
• swarm.getNodeInfo
• swarm.getNodeApps
• swarm.getAppInfos

These endpoints accept a serverId parameter from the requesting client but fail to verify that the serverId belongs to the organization associated with the caller's activeOrganizationId. In a multi-tenant Dokploy deployment, this permits an authenticated user of Organization A to reference and operate on servers provisioned to Organization B. The authorization model appears to be a single-point check (activeOrganizationId) that is not consistently applied across all swarm-related routes.

Component 2: Command Injection in getNodeInfo

The NVD description states that getNodeInfo in packages/server/src/services/docker.ts interpolates the nodeId parameter directly into a shell command executed via execAsyncRemote. Because the serverId ownership check is missing at the API layer, an attacker can pass a crafted nodeId value that contains shell metacharacters. These metacharacters are not neutralized before the value is concatenated into the command string executed remotely over SSH.

Attack Surface and Preconditions

• Authentication: Required (any valid user account with server:read permission).
• Network Exposure: The Dokploy API must be network-accessible; the application typically listens on port 3000.
• Multi-Tenancy: The vulnerability is most impactful in multi-tenant deployments, but it also enables privilege escalation within a single-organization deployment (e.g., a low-privilege user compromising a server they can read but not administer).
• SSH Configuration: Command execution occurs as "the configured SSH user" on the target server, meaning the blast radius inherits the permissions of that user (often root or a user with substantial privileges).

The attack surface is the authenticated API surface of Dokploy. No unauthenticated path exists, which is consistent with the CVSS vector requiring low privileges (PR:L). The scoped nature (S:C) of the CVSS vector indicates that the compromised component is logically separate from other components in the environment, though the high CIA ratings (H/H/H) reflect the full impact of RCE on the target server.

Root Cause Summary: The activeOrganizationId ownership check that should gate all server access is inconsistently applied across swarm routes, and the getNodeInfo service layer does not sanitize nodeId before shell interpolation. The two weaknesses in combination yield a straightforward, high-severity injection path.

Exploitation Scenarios

No public proof-of-concept (PoC) was identified in the provided data; this exploitation walkthrough is inferred from the NVD description and the vulnerability class (CWE-78). The attack chain is described at the class level to avoid fabricating implementation details.

Step 1 — Reconnaissance / Target Identification

The attacker first identifies a Dokploy instance. This can be achieved via internet-wide scanning of port 3000 (the default Dokploy port), using the Shodan dorks listed in the metadata, or by leveraging the distinctive web content of the Dokploy login page. After enumerating the instance, the attacker creates an account or uses credentials for a low-privileged account (e.g., a user with read-only access to a benign server within their own organization). The server:read permission is sufficient for the entire attack chain, per the NVD description.

Step 2 — Triggering the Flaw

The attacker authenticates and obtains a valid session token. They then send crafted requests to one of the vulnerable swarm API endpoints — most significantly swarm.getNodeInfo — supplying a serverId that belongs to another tenant. Because the API does not validate that this serverId corresponds to the attacker's activeOrganizationId, the request is processed. The endpoint retrieves the target server's SSH connection details and invokes the underlying getNodeInfo service function.

Step 3 — Payload / Execution Method (at the Vulnerability Class Level)

Within getNodeInfo, the nodeId parameter (which the attacker can influence as part of the client-supplied request) is interpolated into a shell command string that is executed remotely via execAsyncRemote over the SSH connection to the configured user. A classic command injection payload is supplied in the nodeId field — for example, an ID value followed by shell metacharacters and an injected command. The shell interprets the injected command in addition to the intended docker node inspect operation. This yields arbitrary command execution on the target server as the SSH user.

Step 4 — Post-Exploitation Impact

With command execution on the target server, the attacker gains full control of that host. Depending on the SSH user's privileges, the attacker can:

• Exfiltrate credentials, environment variables, secrets, or data stored on the compromised host.
• Pivot laterally into the internal network reachable from the compromised server.
• Tamper with the tenant's deployed microservices (since Dokploy is a PaaS, the target server hosts multiple applications).
• Install backdoors, cryptocurrency miners, or ransomware.
• Persist via SSH keys, cron jobs, or system service modifications.

The attack is trivial to automate once the API schema is understood, making it highly likely to draw tooling and mass-automated exploitation if the vulnerability becomes more widely known.

Impact Assessment

Business Impact

This vulnerability represents a critical risk for organizations running Dokploy as their internal or customer-facing PaaS. The CVSS v3.1 base score is 9.9 out of 10.0, reflecting:

• Attack Vector: Network (AV:N) — remotely exploitable.
• Attack Complexity: Low (AC:L) — no special conditions; the injection is straightforward.
• Privileges Required: Low (PR:L) — only read access is needed, meaning even the least-privileged user account can trigger it.
• User Interaction: None (UI:N) — no victim interaction required.
• Scope: Changed (S:C) — the compromised server is outside the security boundary of the API component, the impact propagates beyond the vulnerable application.
• Confidentiality/Integrity/Availability: High/High/High — full data disclosure, modification, and denial of service.

Affected Systems and Blast Radius

• All Dokploy versions prior to 0.29.13.
• Any server managed by Dokploy that is reachable over SSH from the Dokploy control plane.
• Multi-tenant deployments face the highest risk because any tenant account can compromise any other tenant's servers — a full tenant-isolation failure.
• Even single-tenant deployments are at risk: a read-only analyst account can escalate to full RCE on every server, bypassing the intended RBAC split between read and admin privileges.

Exploitation in the Wild / Threat Actor Activity

No evidence of active exploitation in the wild, exploit code, or threat actor campaigns was identified in the provided data. The CISA KEV catalog does not list this CVE. However, the vulnerability type (auth-to-RCE via command injection) is perennially targeted by automated ransomware and botnet campaigns once PoC is published.

Detection Guidance

Sigma Rule

title: Dokploy Swarm API Command Injection Attempt
id: 5f9cf8a2-7f69-4e2a-9f10-5d7ca01c4a2b
status: experimental
description: Detects attempts to exploit CVE-2026-72876 - command injection via getNodeInfo in Dokploy
logsource:
  category: webserver
  product: nginx
  service: access
detection:
  selection_api:
    http.url|contains:
      - '/api'
      - '/trpc'
  selection_paths:
    - http.url|contains|all:
        - 'swarm'
        - 'getNodeInfo'
    - http.url|contains|all:
        - 'swarm'
        - 'getNodes'
  selection_payload:
    - http.url|contains|any:
        - ';'
        - '&&'
        - '|'
        - '$(('
        - '`'
        - '%0a'
        - '%3b'
        - '%26%26'
  condition: selection_api and selection_paths and selection_payload
  level: critical
falsepositives:
  - Legitimate admin actions that may reference node IDs containing special characters (unlikely)
fields:
  - client.ip
  - client.user
  - http.url
tags:
  - attack.t1203
  - cve.2026-72876

YARA Rule

rule CVE_2026_72876_Dokploy_Swarm_Command_Injection
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects probable exploit payloads targeting CVE-2026-72876 in Dokploy swarm API requests"
        date = "2026-05-10"
        cve = "CVE-2026-72876"
        severity = "critical"
    strings:
        $api_getNodeInfo = "getNodeInfo"
        $api_getNodes = "getNodes"
        $api_getNodeApps = "getNodeApps"
        $api_getAppInfos = "getAppInfos"
        $swarm_router = "swarm"
        $shell_cmd1 = ";id;"
        $shell_cmd2 = ";uname -a;"
        $shell_cmd3 = "$(whoami)"
        $shell_cmd4 = "|sh"
        $shell_cmd5 = "&&nc "
        $shell_cmd6 = "`id`"
        $env_var = "env"
        $base64 = "base64"
    condition:
        uint16(0) == 0x7B22 // starts with {" indicating JSON body
        and (any of ($api_*))
        and ($swarm_router)
        and (any of ($shell_cmd*) or $base64)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-72876 - Dokploy swarm command injection attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api"; http_uri; content:"swarm"; http_uri; content:"getNodeInfo"; http_uri; content:"nodeId"; http_client_body; pcre:"/(;|\||&&|`|\$\(|\$)*[\s\S]{0,1024}(id|uname|whoami|cat|nc|wget|curl|base64|sh|csh|bash)/iR"; classtype:attempted-admin; sid:2026728761; rev:1; metadata:created_at 2026-05-10, cve CVE-2026-72876;)

Elastic Detection

sequence by source.ip, user.name with maxspan=15s
  [ any where process.name == "nginx" and
      network.protocol == "http" and
      url.path in ("/api", "/trpc") and
      wildcard(url.path, "*swarm*") and
      (wildcard(url.path, "*getNodeInfo*") or wildcard(url.path, "*getNodes*")) ]
  [ any where process.name == "ssh" and
      event.action in ("exec", "session_start") and
      process.command_line regex~ ".*(/bin/|/usr/bin/|\s|;|&&|\|).*" and
      process.command_line regex~ ".*(docker|node|id|uname|whoami).*" ]

Splunk SPL Query

index=web sourcetype=access_combined 
| search uri_path IN ("/api*", "/trpc*") 
| search uri_path IN ("*swarm*") AND (uri_path="*getNodeInfo*" OR uri_path="*getNodes*" OR uri_path="*getNodeApps*" OR uri_path="*getAppInfos*")
| rex field=uri_query "nodeId=(?<nodeId>[^&]+)"
| where match(nodeId, "(;|\||&&|`|\$\(|%0a|%3b|%26%26)")
| eval outcome="POTENTIAL_CVE-2026-72876_EXPLOIT"
| table _time, src_ip, user, uri_path, uri_query, nodeId, http_user_agent
| sort - _time

Wazuh OSSEC Rule

<group name="dokploy, cve-2026-72876,command_injection,">
  <rule id="100276" level="15" frequency="3" timeframe="300">
    <if_sid>31105</if_sid>
    <field name="url" type="pcre2">(?i)(/api|/trpc).*(swarm).*(getNodeInfo|getNodes|getNodeApps|getAppInfos)</field>
    <description>CVE-2026-72876: Possible Dokploy swarm command injection attempt detected (multiple occurrences)</description>
    <group>attack.t1203, cve-2026-72876,</group>
    <options>no_full_log</options>
  </rule>
  <rule id="100277" level="12" timeframe="60">
    <if_sid>31105</if_sid>
    <field name="url" type="pcre2">(?i)(getNodeInfo|getNodes).*(nodeId).*?(;|\||&&|`|\$\(|%0a|%3b)</field>
    <description>Single CVE-2026-72876 command injection test in Dokploy swarm API request</description>
    <group>attack.t1203, cve-2026-72876,</group>
    <options>no_full_log</options>
  </rule>
  <rule id="100278" level="5">
    <if_sid>31105</if_sid>
    <field name="url" type="pcre2">(?i)(/api|/trpc).*(swarm).*(getNodeInfo|getNodes)</field>
    <description>Dokploy swarm endpoint access observed (normal usage baseline)</description>
    <group>dokploy,</group>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source).

⚠ NOTE: The NVD description states the issue is fixed in version 0.29.13. The patch confidence metric of 0/4 reflects that no upstream patch diff or dedicated patch source was confirmed in this report's tracked intelligence sources. Treat version 0.29.13 as the likely remediation target and validate the upgrade in your environment.

1) Immediate Mitigations (apply now, before upgrading):

• Restrict network access to the Dokploy API (port 3000) using firewall rules or security groups. Only allow connections from trusted administrative networks; block direct internet exposure.
• Audit and disable unused user accounts — specifically disable or delete accounts with only server:read permission if they serve no operational purpose, as this permission level is sufficient to exploit the flaw.
• Enable multi-factor authentication (MFA) on all accounts to raise the bar for compromise of low-privilege accounts.
• Monitor the SSH user configured in Dokploy for each managed server. If this user has broad sudo privileges or is root, restrict it to a dedicated role with only the Docker commands required for orchestration.
• Isolate the Dokploy control plane from production networks where possible; segment tenant servers into separate security zones.

2) Patch / Upgrade Steps:

• Upgrade Dokploy to version 0.29.13 or later. The vulnerability is reported to be fixed in that release.
• Prior to upgrade, review release notes and changelogs for 0.29.13 to confirm the fix addresses the swarm API authorization gap and the getNodeInfo command injection.
• Test the upgrade in a staging environment that mirrors your production topology (multi-tenant setup with at least two organizations and two servers).
• After upgrade, verify that a user from Organization A can no longer query or issue commands against Organization B's servers.

3) Long-Term Hardening:

• Implement a defense-in-depth approach for API authorization. Consider placing an API gateway in front of Dokploy that enforces tenant isolation at a central layer, independent of application-level checks.
• Subscribe to the Dokploy security advisories (GitHub releases, mailing list) for early notification of future vulnerabilities.
• Deploy an intrusion detection/prevention system (IDS/IPS) with rules tuned for the detection patterns in this report.
• Adopt a least-privilege model for SSH users managed by Dokploy — execute Docker node queries as a dedicated user without sudo access to the host operating system.
• Establish a patch management SLA for critical CVEs (CVSS ≥ 9.0) requiring remediation within 48 hours.

References

1. NVD Entry for CVE-2026-72876 — https://nvd.nist.gov/vuln/detail/CVE-2026-72876
2. Dokploy Official Repository (identification of affected files and version) — https://github.com/Dokploy/dokploy
3. CWE-78: Improper Neutralization of Special Elements used in an OS Command — https://cwe.mitre.org/data/definitions/78.html
4. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (verified: CVE-2026-72876 NOT listed)
5. FIRST EPSS (Exploit Prediction Scoring System) — https://www.first.org/epss/ (not yet scored for this CVE)

Threat Actor / Exploit-in-the-Wild Evidence: No threat actor campaigns, in-the-wild exploitation, or published exploit code for CVE-2026-72876 were identified in the provided intelligence data at the time of this report. The vulnerability remains a high-priority target for security teams to patch proactively before exploit tooling emerges.