Vulnerabilidades em Dokploy

53 resultados
Análise Vexday

Dokploy apresenta um panorama de risco significativo com 18 vulnerabilidades registradas, sendo 11 críticas (CVSS ≥9.0) e 11 publicadas nos últimos 90 dias, indicando um padrão recente de descobertas. Embora nenhuma esteja sob exploração ativa documentada (KEV), a predominância de injeção de comando (CWE-78) representa um vetor de ataque direto e de alto impacto que demanda remediação prioritária. A concentração de críticas em período recente sugere questões estruturais na base de código que merecem revisão urgente.

CVE-2026-72866HIGHWebSocket Terminal Auth BypassEPSS —CVE-2026-72882CRITICALDokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed serversEPSS —CVE-2026-72734HIGHDokploy: Cross-organization authorization bypass in server.remove allows deletion of another organization's server registrationEPSS —CVE-2026-72879CRITICALDokploy: Command Injection via Registry Credentials in Swarm UploadEPSS —CVE-2026-72737CRITICALDokploy: Cross-organization IDOR in Dokploy backup destinations exposes another tenant's S3 credentials and backupsEPSS —CVE-2026-72874HIGHDokploy: Command Injection via Unescaped Git URL in Clone CommandsEPSS —CVE-2026-72863CRITICALDokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker hostEPSS —CVE-2026-72884HIGHDokploy: Command Injection via Compose Custom CommandEPSS —CVE-2026-72740CRITICALDokploy: OS Command Injection via SSH-form `customGitUrl` domain in `ssh-keyscan`EPSS —CVE-2026-72739MEDIUMDokploy: Command Injection via Compose Shell ExecutionEPSS —CVE-2026-72881MEDIUMDokploy: Command Injection via database credentials in backup/restore commandsEPSS —CVE-2026-72870HIGHDokploy: Command Injection via Docker Credentials in buildRemoteDockerEPSS —CVE-2026-72883HIGHDokploy: WebSocket Terminal Missing Service-Level Access ControlEPSS —