Dokploy versions before 0.31.1 contain a critical OS command injection flaw (CVSS 3.1: 9.9) that lets an authenticated organization member run shell commands as root and take over the host through the mounted Docker socket.
What Is It
CVE-2026-129433 is an OS command injection vulnerability (CWE-78) in Dokploy's getComposeContainerCommand() function. The flaw is in how the serviceName parameter is handled. An attacker can store a serviceName value containing shell metacharacters through the backup.create or backup.update tRPC procedures. The injected commands run as root when the scheduled backup executes.
VulnCheck disclosed the vulnerability, and it was published to NVD on 2026-11-14. NVD lists the record's status as "Deferred."
Why It Matters
- Severity: CVSS 3.1 base score 9.9 (CRITICAL), vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The CVSS 4.0 score is 9.4 (CRITICAL). - Low barrier: The attack works over the network with low complexity. It needs only low privileges, meaning an authenticated organization member, and no user interaction.
- Host compromise: The commands run as root during scheduled backups, and the mounted Docker socket gives a path to full host takeover. The scope is "Changed," so the impact reaches beyond the vulnerable component itself.
- Persistence through scheduling: The malicious payload is stored in the backup configuration, so it runs every time the scheduled backup runs, without any further action from the attacker.
Exploitation status: This CVE has no entry in the CISA Known Exploited Vulnerabilities (KEV) catalog, and the supplied data does not confirm active exploitation.
What's Vulnerable
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Dokploy | dokploy (pkg:github/Dokploy/dokploy) |
All versions < 0.31.1 | 0.31.1 |
Any Dokploy deployment running a version below 0.31.1 is affected. This is especially serious where organization membership includes users who should not have root-level access to the host.
Patch Status
Dokploy fixed the issue in version 0.31.1. The fix is available in the v0.31.1 release, commit b24006e, and pull request #5908. Administrators should:
- Upgrade Dokploy to 0.31.1 or later.
- Review existing compose backup configurations for
serviceNamevalues that contain shell metacharacters, since stored payloads may already be present. - Audit organization membership to limit who can create or update backups.
There is no CISA KEV required-action deadline for this CVE.