Database/Container, Kubernetes & orchestration

Dokploy: registry password and URL interpolated unescaped into a swarm deploy command

CVSS 9.4CVE-2026-72879Container, Kubernetes & orchestrationcurated

Impact

getRegistryCommands() builds a shell command from registry.password and registry.registryUrl without escaping, so a member who can configure a registry and trigger a swarm deployment executes arbitrary commands on the Dokploy server itself. With the Dokploy process holding Docker socket access, that reads and modifies host files and reaches every other container on the box - the control plane, not just one tenant's workload. Note the fixed version differs from the other Dokploy injections in this batch: this one is fixed in 0.29.8, the others in 0.29.13, so an operator sitting between those releases is exposed to one set and not the other.

Who can reach it

Network access to the Dokploy API with an authenticated account that has project access sufficient to configure registry credentials and start a swarm deployment. Execution happens on the Dokploy server when the deployment runs.

What to do

Upgrade to Dokploy 0.29.8 or later and restart the Dokploy stack (fix in commit 1f4f940); 0.29.13 is the right target anyway because of the other injections fixed there. No mitigation short of the upgrade is published. The restart interrupts in-flight deploys but does not require draining managed nodes. On a shared instance, rotate registry credentials and anything else reachable from the Dokploy host.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-72879 https://github.com/Dokploy/dokploy/security/advisories/GHSA-prwq-2mcm-mvhr https://github.com/Dokploy/dokploy/commit/1f4f94042f1d874349c42d8ae7fee51346cd086e https://github.com/Dokploy/dokploy/releases/tag/v0.29.8

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.