CVE-2026-24841

CRITICAL

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint `/docker-container-term...

Affects 1 product across 1 vendor.

CVSS 3.19.9
EPSS2.8%
Percentile86th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-78: OS Command Injection

Attacker injects OS commands through application inputs passed to system() or equivalent calls, leading to arbitrary command execution.

Related Attack Patterns (CAPEC)
CAPEC-43 Exploiting Multiple Input Interpretation Layers
via CWE-78
CAPEC-108 Command Line Execution through SQL Injection
via CWE-78
CAPEC-6 Argument Injection
via CWE-78
CAPEC-15 Command Delimiters
via CWE-78
CAPEC-88 OS Command Injection
via CWE-78

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A critical command injection vulnerability exists in Dokploy's WebSocket endpoint /docker-container-terminal, affecting versions prior to 0.26.6, allowing authenticated attackers to execute arbitrary commands on the host server.

BSID: BS-2026-GLOBAL-072887-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2026-24841?
A critical command injection vulnerability exists in Dokploy's WebSocket endpoint /docker-container-terminal, affecting versions prior to 0.26.6, allowing authenticated attackers to execute arbitrary commands on the host server.
What is the CVSS score for CVE-2026-24841?
CVE-2026-24841 has CVSS 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS: 2.8%.
Is CVE-2026-24841 actively exploited?
No confirmed active exploitation of CVE-2026-24841 as of 2026-05-30.
How do I remediate CVE-2026-24841?
Priority: IMMEDIATE. PSIRT: [email protected]
What systems are affected by CVE-2026-24841?
CVE-2026-24841 affects Dokploy Dokploy.
Vulnerability Details
CVE IDCVE-2026-24841
BSIDBS-2026-GLOBAL-072887-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published2026-01-28
Last Modified2026-02-04
ICS Relevance15%
Weakness (CWE)
OS Command Injection
SourceNVD
Official Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint `/docker-container-terminal`. The `containerId` and `activeWay` parameters are directly interpolated into shell commands without sanitization, allowing authenticated attackers to execute arbitrary commands on the host server. Version 0.26.6 fixes the issue.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from the direct interpolation of `containerId` and `activeWay` parameters into shell commands without proper sanitization in the WebSocket endpoint `/docker-container-terminal`.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Dokploy Dokploy < 0.26.6
Remediation

No official vendor advisory link on record. See the CVE record →

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 261 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashdb5fef9638d0a978ec1bb12275b1d64ae112209c65cc6428f8e7bdfc50a26f8d4b6753857b593e66014d122848730008372c916bf1394df6c1b78c62d2873119
Related CVEs affecting Dokploy
CVE-2026-27130 9.9 Dokploy is a free, self-hostable Platform as a Service (PaaS). Versions 0.26.... CVE-2026-82954 9.9 A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the ... CVE-2025-53825 9.8 Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to versi... CVE-2025-53376 8.8 Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the d... CVE-2026-24840 8.8 Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions pr...
View all Dokploy CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.9 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →