CVE-2026-27130 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-27130 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-27130 is a critical OS command injection flaw in Dokploy, a self-hostable PaaS. Versions 0.26.6 and below are affected. An authenticated attacker can place shell metacharacters in the appName field during app creation, and those characters may later be executed with server-level privileges when service actions such as start, stop, remove, or scale are triggered.

This is especially dangerous for solo developers and small teams because Dokploy often sits close to deployment credentials, source code, and infrastructure access. Even though this issue is not known to be exploited in the wild and is not in CISA KEV, the severity is CRITICAL (CVSS 9.9) and the fix is available in 0.26.7.

Immediate Action

  • Upgrade immediately to Dokploy 0.26.7 or later. If you cannot patch right away, disable access to app creation and service operations for untrusted users.
  • Review recent app names for suspicious characters such as ;, |, &, backticks, $(), or unexpected command-like strings.
  • Isolate the host running Dokploy from sensitive internal systems until patched. Assume an attacker who can create an app may be able to execute commands on the server.
  • Rotate secrets if you suspect abuse: deployment tokens, SSH keys, API keys, registry credentials, and any environment variables exposed on the host.
  • Back up first, then patch. If you rely on a custom deployment image or self-hosted install, test the upgrade in a staging copy before rolling it to production.
  • Check the vendor’s release notes or advisory page: Dokploy security advisory / release notes.

Affected Versions

  • dokploy@<=0.26.6 vulnerable; upgrade to 0.26.7+
  • dokploy@0.26.7 and later: fixed

Resolution Guide

Recommended fix: upgrade Dokploy to 0.26.7 or newer using the method you used to install it.

# npm
npm install dokploy@0.26.7

# yarn
yarn add dokploy@0.26.7

# pnpm
pnpm add dokploy@0.26.7

# pip / pipx (only if you installed a Python wrapper or related tooling)
pip install --upgrade dokploy==0.26.7
pipx upgrade dokploy

# Maven / Gradle
# TODO: replace with the actual Dokploy artifact coordinates if applicable
# Maven
mvn versions:use-latest-releases

# Gradle
./gradlew dependencyUpdates

# Debian / Ubuntu
sudo apt update
sudo apt install --only-upgrade dokploy

# RHEL / CentOS / Fedora
sudo yum update dokploy
# or
sudo dnf update dokploy

# Docker
docker pull dokploy/dokploy:0.26.7
docker compose up -d --force-recreate

Hardening while you patch:

# Example: restrict who can create apps or trigger service operations
# TODO: adapt to your deployment method / env vars
export DOKPLOY_DISABLE_APP_CREATION=true
export DOKPLOY_DISABLE_SERVICE_ACTIONS=true

# If you run behind a reverse proxy, temporarily restrict access:
# allow only your IP/VPN, or require admin-only access

Minimal code fix pattern: do not pass user-controlled names directly to a shell. Validate against a strict allowlist and avoid shell interpolation.

// BAD: direct shell interpolation
await execAsync(`start-service ${appName}`);

// BETTER: strict validation + argument array / no shell
const safeName = appName.trim().toLowerCase();
if (!/^[a-z0-9-]{1,63}$/.test(safeName)) {
  throw new Error("Invalid app name");
}
await execFileAsync("start-service", [safeName], { shell: false });

If you maintain a fork or custom plugin, search for execAsync() and execAsyncRemote() calls that include appName or other user input, and replace them with non-shell process execution.

Detection & Verification

Check your version:

# If installed via package manager
dokploy --version

# If using Docker
docker ps --format '{{.Image}} {{.Names}}' | grep -i dokploy

# If installed from source
grep -R "version" . | head

Look for the vulnerable pattern in code or a fork:

grep -R "execAsyncRemote\|execAsync\|cleanAppName\|appName" .

Search for suspicious app names in logs or database records:

# Shell metacharacters often used in injection attempts
grep -R -nE '[;&|`$()][^[:space:]]*' /var/log /path/to/dokploy/data 2>/dev/null

Verify the fix: after upgrading to 0.26.7, create a test app with a name containing a blocked character such as test;id. The UI/API should reject it, normalize it safely, or store it without ever reaching a shell command.

# Example API test (adjust endpoint/auth to your setup)
curl -s -X POST https://YOUR-DOKPLOY/api/apps \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"appName":"test;id"}'

Dependency audit: if Dokploy is bundled in your stack, run your normal auditor and confirm the installed version is at least 0.26.7.

Risk and Impact

Successful exploitation can lead to arbitrary command execution on the Dokploy host with the privileges of the service process. That can mean reading secrets, altering deployments, installing persistence, or pivoting into connected infrastructure. For small teams, the blast radius may include production environments, source repositories, container registries, and cloud credentials stored on the same machine.

Because the attacker must be authenticated, this is not a drive-by bug, but it is still urgent: any compromised team account, leaked token, or low-privilege user with app creation access could become a full server compromise.

Keep reading