CVE-2026-45629 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-45629 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-45629 is a critical authenticated command-injection flaw in Dokploy affecting 0.28.8 and earlier. A member of any organization using the vulnerable /listen-deployment WebSocket endpoint can execute arbitrary system commands on remote servers managed by Dokploy. In practice, this can mean full server compromise, data theft, persistence, and lateral movement into connected infrastructure.

This is especially urgent for solo developers and small teams because Dokploy often sits close to your deployment keys, environment secrets, and production hosts. Even without known in-the-wild exploitation, the impact is severe enough to treat as an emergency patch-and-audit event.

Immediate Action

  • Upgrade Dokploy immediately to a fixed release as soon as it is available. If the vendor advisory does not yet list a patched version, use the latest release notes and TODO placeholder below: upgrade to Dokploy > TODO-fixed-version.
  • Temporarily restrict access to Dokploy’s admin and deployment interfaces to trusted IPs/VPN only. If you cannot patch right away, isolate the service from the public internet.
  • Disable or block the /listen-deployment WebSocket endpoint at the reverse proxy/WAF if your setup allows it, until patched.
  • Rotate secrets that Dokploy can access: SSH keys, API tokens, registry credentials, cloud credentials, and app environment variables.
  • Review server logs and process activity for suspicious shell commands, unexpected child processes, or new users/cron jobs.
  • Check the vendor advisory and release notes for the exact fixed build: Dokploy security advisory / release notes.

Affected Versions

  • dokploy@0.28.8 and earlier: vulnerable
  • dokploy@TODO-fixed-version and later: safe (replace with the first patched release from the vendor)

Resolution Guide

1) Patch or upgrade Dokploy now. Use the install method that matches your deployment.

# npm
npm install dokploy@TODO-fixed-version

# yarn
yarn add dokploy@TODO-fixed-version

# pnpm
pnpm add dokploy@TODO-fixed-version

# pip
pip install --upgrade dokploy==TODO-fixed-version

# pipx
pipx upgrade dokploy

# Maven (if packaged internally)
# Update the version in pom.xml to TODO-fixed-version

# Gradle
# Update implementation '...:dokploy:TODO-fixed-version' in build.gradle

# apt/yum (if you installed from a package repo)
sudo apt update && sudo apt install --only-upgrade dokploy
sudo yum update dokploy

# Docker
docker pull dokploy/dokploy:TODO-fixed-version
docker stop dokploy && docker rm dokploy
docker run ... dokploy/dokploy:TODO-fixed-version

2) If you cannot patch immediately, harden access.

# Example: block the endpoint at Nginx
location ~* ^/listen-deployment {
    deny all;
    return 403;
}

# Example: restrict Dokploy to a VPN or internal subnet
allow 10.0.0.0/8;
allow 192.168.0.0/16;
deny all;

3) Reduce blast radius. Run Dokploy with the least privilege possible, separate it from production secrets where feasible, and ensure the host account cannot freely manage unrelated systems.

4) Minimal code fix pattern for maintainers: never pass WebSocket input to a shell command. Use allowlists and argument arrays instead of string concatenation.

// Unsafe
exec(`deploy --id ${msg.id} --env ${msg.env}`)

// Safer
import { spawn } from 'node:child_process';

const allowedEnv = new Set(['staging', 'production']);
if (!allowedEnv.has(msg.env)) throw new Error('Invalid env');

spawn('deploy', ['--id', String(msg.id), '--env', msg.env], {
  shell: false,
  stdio: 'inherit'
});

Detection & Verification

Check whether you are vulnerable:

# If installed via package manager
dokploy --version

# If running in Docker
docker image ls | grep -i dokploy
docker inspect dokploy --format '{{.Config.Image}}'

# Search deployment manifests
grep -Rni "dokploy" /etc /opt ~/docker-compose* . 2>/dev/null

# Check lockfiles and manifests
grep -Rni "0.28.8\|0.28." package-lock.json yarn.lock pnpm-lock.yaml requirements.txt pom.xml build.gradle 2>/dev/null

Look for signs of abuse:

# Web server / app logs
grep -Rni "listen-deployment\|websocket\|ws://" /var/log 2>/dev/null

# Suspicious process activity
ps auxf | egrep 'sh|bash|curl|wget|nc|python|perl|ruby|node'

# Recent changes
find /etc /usr/local /opt -mtime -7 -type f 2>/dev/null | head
crontab -l
sudo ls -la /etc/cron* 2>/dev/null

Verify the fix:

# Confirm upgraded version
dokploy --version

# Confirm Docker tag
docker inspect dokploy --format '{{.Config.Image}}' | grep TODO-fixed-version

# Re-run dependency audit where applicable
npm audit
yarn audit
pnpm audit
pip audit
mvn -q -DskipTests dependency:tree
./gradlew dependencies

Risk and Impact

This flaw can turn a normal authenticated Dokploy user into a remote code execution path on the underlying server. Because Dokploy often manages deployment credentials, the attacker may gain access to source code, environment secrets, databases, and cloud resources tied to that host. For small teams, the blast radius can include production outages, leaked customer data, and complete rebuilds of affected servers.

Bottom line: treat this as a critical patch-now issue. If you run Dokploy at 0.28.8 or earlier, assume the host is at risk until upgraded and verified.

Keep reading