CVE-2026-72879

Executive Summary

CVE-2026-72879 is a pre-authentication-independent but authenticated OS command injection vulnerability in Dokploy, a free, self-hostable Platform-as-a-Service (PaaS). In versions prior to 0.29.8, the getRegistryCommands() function in packages/server/src/utils/cluster/upload.ts interpolates the user-controlled registry.password and registry.registryUrl values directly into a shell command without escaping or sanitization. Any authenticated user with project access can weaponize registry credentials and trigger a Docker Swarm deployment to achieve arbitrary OS command execution on the Dokploy server, with the ability to read or modify host files and reach other containers through the Docker daemon. The flaw is fixed in version 0.29.8, per a single-source claim (OSV) with patch confidence rated 2/4.

Technical Analysis

The vulnerability is an instance of CWE-78 (Improper Neutralization of Special Elements used in an OS Command — "OS Command Injection"). The vulnerable code path resides in getRegistryCommands(), defined in packages/server/src/utils/cluster/upload.ts. According to the NVD description, this function builds Docker Swarm deployment commands by interpolating two registry-related variables — registry.password and registry.registryUrl — straight into a shell command string. Because the interpolation is performed without shell escaping (no quoting, no parameterized process invocation), any shell metacharacters embedded in these fields survive into the final command line and are interpreted by the shell.

From the data provided, the precise shell command structure, the deployment API endpoint, and the transport layer used to invoke the vulnerable function are not disclosed. This report therefore describes the flaw at the vulnerability-class level where specifics are missing, and strictly uses only the artifacts named in the NVD description — the function name, the source file path, and the two interpolated fields — as the technical anchor points.

The attack surface is the Dokploy control plane: a self-hosted PaaS server that manages container deployment via Docker Swarm. The Dokploy web application (and its API) is the entry point. The threat model is significant because the affected component runs with the privileges needed to drive the Docker daemon — meaning successful exploitation grants the attacker not just a shell as the service user, but effective control over the container runtime and, by extension, the host operating system.

Notably, no CVSS vector or score has been officially published for this CVE at the time of writing; the CVSS metadata remains N/A. The EPSS score of 0.00278 (20.3rd percentile of exploited CVEs) indicates a low current probability of exploitation in the wild as of scoring, and CISA KEV does not list this CVE. These metrics should be re-checked periodically, as command injection flaws in self-hosted management consoles are routinely chained into broader intrusions once PoC material circulates. Insufficient technical detail is available to reconstruct the exact command template; whatever the surrounding logic, the dangerous pattern — concatenating untrusted strings into a shell command — is confirmed by the NVD description.

Exploitation Scenarios

No public PoC or exploit code is currently known for CVE-2026-72879; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. An attacker first identifies exposed Dokploy instances via internet-wide scanning, using fingerprints such as the Dokploy login page, API banner, or distinctive HTTP responses (see Shodan dorks in METADATA). Dokploy is commonly reachable on standard web ports behind a reverse proxy. The attacker then determines whether the installed version is prior to 0.29.8 by examining the UI version string, the server's /version-style endpoint, or deployment artifacts.

2. Authentication and access establishment. The attacker needs a valid account with project access on the target Dokploy instance. Because Dokploy is designed for collaborative multi-project use, an account with project-level permissions — a developer, a CI/CD integration account, or a compromised low-privileged user — is sufficient. The vulnerability does not require administrative privileges within the platform, only project access.

3. Flaw trigger / payload injection. Within the project's registry configuration, the attacker sets registry.password (and/or registry.registryUrl) to a value that embeds shell metacharacters — for example a command substitution $(malicious_command), backticks, a command separator (;), or a logical operator (&&, |). A crafted registry URL such as https://registry.example.com/$(id > /tmp/pwned) would be one possible class of payload. The attacker then initiates a Docker Swarm deployment for the project, which causes the Dokploy server to call getRegistryCommands() in packages/server/src/utils/cluster/upload.ts. The malicious values are interpolated unescaped into the shell command string and executed with the privileges of the Dokploy server process.

4. Post-exploitation impact. The injected command executes on the Dokploy server host. The NVD description states the attacker can read or modify host files and access other containers through Docker. Practical follow-on actions include: exfiltrating secrets from the file system (/etc/shadow, environment files, TLS keys, registry credentials of other projects), planting persistence (cron jobs, SSH authorized_keys, systemd units), pivoting via Docker socket/API to inspect or compromise other containers managed by the platform, and potentially launching supply-chain attacks against every application hosted on the Dokploy instance. In a typical self-hosted deployment, the Dokploy service runs as root or with Docker socket access, which normally results in full host compromise in short order.

It is acceptable to note that the attack chain requires valid credentials; this is not a zero-click, unauthenticated vulnerability. The severity stems from the low privilege barrier (any project user) combined with the catastrophic consequence (host RCE).

Impact Assessment

The business impact of CVE-2026-72879 must be rated as critical from a qualitative standpoint, despite the absence of an official CVSS vector (N/A).

• Confidentiality: Arbitrary read access to host files and container filesystems. Secrets, source code, customer data, and platform credentials of all hosted projects are exposed.
• Integrity: Arbitrary file modification on the host and inside Docker containers; ability to inject malicious code into the PaaS platform itself, into deployed workloads, or into CI/CD pipelines integrated with Dokploy.
• Availability: Full server takeover enables destructive actions — deletion of volumes, disruption of all hosted applications, ransomware-style encryption of the host and container storage.
• Blast radius: The PaaS model concentrates risk. One compromised Dokploy server compromises every project, every container, and every downstream consumer hosted on that instance. In organizations using shared self-hosted infrastructure across tenants or business units, the blast radius crosses internal trust boundaries.
• Exploitability factors: Authentication is required, but only at the "project access" level, which may be granted to many developers, external contractors, or automation accounts. Public-facing deployment of Dokploy expands the exposure; internally-deployed instances are reachable by any attacker who has already gained a foothold in the corporate network, making this a valuable post-exploitation escalation primitive.
• Current threat landscape: Low EPSS (0.00278), no CISA KEV inclusion, no public PoC as of writing. Historical patterns for CWE-78 flaws in self-hosted DevOps tools indicate that public exploit release or inclusion in automated exploitation tooling frequently follows advisory publication; there is no information available about specific threat actor campaigns targeting this CVE at this time.

Detection Guidance

The following detection content is designed to identify both the hostile configuration writes (registry credentials containing shell metacharacters) and the resulting anomalous process execution on the Dokploy server. Because no public PoC exists, these rules target the vulnerability class and the observable side effects of exploitation.

Sigma Rule

title: Dokploy Server Suspicious Shell Execution via Node Parent (CVE-2026-72879)
id: 3f6d1c92-7b41-4a6e-9c9d-2d5f0a1c6e82
status: experimental
description: >
  Detects a shell process (sh/bash/dash) spawned by the Dokploy Node.js server
  process with a "-c" argument and Docker/Swarm/registry-related content,
  consistent with OS command injection via unescaped registry credentials
  (CVE-2026-72879).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-72879
author: ValtersIT Threat Intelligence
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - /node
      - /nodejs
  selection_shell:
    Image|endswith:
      - /sh
      - /bash
      - /dash
  selection_c:
    CommandLine|contains: '-c'
  selection_suspicious:
    CommandLine|contains:
      - docker
      - swarm
      - registry
  condition: selection_parent and selection_shell and selection_c and selection_suspicious
falsepositives:
  - Legitimate Dokploy deployment operations involving Docker Swarm registries
level: high

YARA Rule

rule dokploy_registry_credential_cmd_injection
{
    meta:
        author      = "ValtersIT Threat Intelligence"
        description = "Detects Dokploy registry credential payloads containing shell metacharacters consistent with CVE-2026-72879 command injection"
        cve         = "CVE-2026-72879"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-72879"
    strings:
        $k1 = "registryUrl" ascii wide
        $k2 = "registry.password" ascii wide
        $k3 = "getRegistryCommands" ascii wide
        $c1 = "$(" ascii
        $c2 = "`" ascii
        $c3 = "&&" ascii
        $c4 = ";" ascii
        $c5 = "|" ascii
    condition:
        filesize < 5MB and any of ($k*) and 2 of ($c*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Dokploy Registry Command Injection Attempt (CVE-2026-72879)"; flow:established,to_server; content:"registry"; http_client_body; pcre:"/(?:registryUrl|registry\.password)[^\r\n]{0,256}(?:\x60|\$\x28|;|\|\||&&)/i"; reference:cve,2026-72879; classtype:attempted-admin; sid:2300047; rev:1;)

This rule inspects HTTP request bodies for the registry configuration fields (as named in the NVD description) followed by shell metacharacters within a short window, which is the fingerprint of a payload crafted for getRegistryCommands().

Elastic Detection

process where process.name in ("sh", "bash", "dash")
  and process.parent.name in ("node", "nodejs")
  and process.args == "-c"
  and process.command_line like "*docker*"
  and (process.command_line like "*`*"
       or process.command_line like "*$(*"
       or process.command_line like "*&&*"
       or process.command_line like "*;*")

This EQL query correlates the exact process lineage expected when the Dokploy Node.js server executes an injected shell command during a Swarm deployment.

Splunk SPL Query

index=linux sourcetype=linux_audit OR sourcetype=bash OR sourcetype=syslog
| search process_name="sh" OR process_name="bash" OR process_name="dash"
| search command_line="*-c*"
| search command_line="*docker*" OR command_line="*swarm*"
| regex command_line="[\$\`;&|]"
| table _time host user process_name parent_process command_line
| sort - _time

Wazuh OSSEC Rule

<group name="dokploy,">
  <rule id="100340" level="12">
    <if_sid>5716</if_sid>
    <regex>^.*(sh|bash|dash) -c .*(docker|swarm|registry)</regex>
    <regex>^.*[\$\`;&|]</regex>
    <description>CVE-2026-72879: potential Dokploy OS command injection via malicious registry credentials</description>
    <group>attck.execution,attck.t1059,gdpr_IV_35.7.d,</group>
    <mitre>
      <tactic>TA0002</tactic>
      <technique>T1059</technique>
    </mitre>
  </rule>
</group>

This rule filters execve audit events (Wazuh rule 5716) for shell invocations that contain both Docker/Swarm/registry context and shell metacharacters, which is the observable signature of exploitation.

Mitigation & Patch Guidance

Patch confidence is 2/4 — the fix is claimed by a single source (OSV) and has not been independently confirmed through a vendor advisory, changelog, or code review. Treat the environment as vulnerable until verified.

1. Immediate mitigations (before patching):

   • Upgrade Dokploy to version 0.29.8 or later immediately. This is the only known remediation.
   • If upgrade is not immediately possible, restrict access to the Dokploy web UI and API to trusted networks/VPNs only, and strictly limit the number of accounts with project access.
   • Audit existing registry credential configurations; remove or rotate any credentials containing shell metacharacters or suspicious syntax.
   • Monitor Docker daemon and node shell activity on the Dokploy server for anomalous process executions.
   • Disable or restrict Docker socket access for the Dokploy service where possible until the patch is verified.

2. Patch/upgrade steps:

   • Independently verify the fix: confirm the release notes for 0.29.8 reference CVE-2026-72879, or inspect packages/server/src/utils/cluster/upload.ts to confirm that registry.password and registry.registryUrl are no longer interpolated unescaped into shell commands (e.g., they are passed as arguments, base64-encoded, or adequately quoted).
   • Back up all Dokploy data and configuration before upgrading.
   • Test the upgraded version in a staging environment, including a full Swarm deployment cycle.
   • After upgrade, rotate all registry credentials and all secrets that may have been exposed through the vulnerable server.

3. Long-term hardening:

   • Run Dokploy with the least privilege required; avoid root execution if the deployment model permits.
   • Apply network segmentation so the Dokploy control plane is not reachable from the general corporate network or the internet.
   • Enforce multi-factor authentication and the principle of least privilege on all Dokploy accounts.
   • Integrate Dokploy server logs into the SIEM and subject host process creation (especially shell and docker executions) to behavioral monitoring.
   • Maintain a recurring review of all third-party, self-hosted PaaS/CI-CD components for CVEs, and subscribe to vendor/OSV notifications for Dokploy advisories.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-72879
2. OSV Vulnerability Record — https://osv.dev/vulnerability/CVE-2026-72879 (patch claim source; confidence 2/4)
3. Dokploy Project Repository (source path packages/server/src/utils/cluster/upload.ts referenced in the advisory) — https://github.com/Dokploy/dokploy
4. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-72879 is NOT listed; verify periodically)
5. CWE-78 Reference — https://cwe.mitre.org/data/definitions/78.html

No public PoC, exploit code, or threat-actor campaign associated with CVE-2026-72879 is known at the time of writing; this report does not include Indicators of Compromise (IOCs) specific to this CVE because none have been published.