Dokploy: RCE via validator

Dokploy

Dokploy's validator allows the backtick, enabling host RCE, tested against v0.31.0

Do this now

Check Dokploy's vendor advisory for a fix and restrict access to the Dokploy host to trusted users until one ships.

Who should check: teams running Self-hosted apps

First seen: 10 Nov 2026
Last update: 10 Nov 2026, 03:17 UTC
Versions per the CVE record from GitHub_M, not the vendor: 0.29.13
Identifiers: CVE-2026-72868
CVSS: 9.9
Source: news
On the menu as: Self-hosted apps

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Dokploy: RCE via validator
Severity: critical. Patch status: fix status unknown.
Affected: Dokploy
Versions per the CVE record from GitHub_M, not the vendor: 0.29.13
Ids: CVE-2026-72868

Dokploy's validator allows the backtick, enabling host RCE, tested against v0.31.0

## Steps
1. Search the repo, its CI and infra config for Dokploy. If present, report the version in use and whether it's affected.
2. Versions per the CVE record from GitHub_M, not the vendor: Dokploy: 0.29.13. Don't treat them as a fix until the vendor says so.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Dokploy | per the CVE record from GitHub_M, not the vendor | 0.29.13 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-72868") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://seclists.org/oss-sec/2026/q4/620
https://pwned.coffee/i/dokploy-rce-via-validator

Timeline

10 Nov 2026, 03:17 UTC
Fix status: no fix yet → unknown.
10 Nov 2026
First reported.

Receipt

Exploitation: No known exploitation
By release line, per the CVE record from GitHub_M, not the vendor: Product Affected Version named Source
Dokploy before 0.29.13 0.29.13 CVE record (CNA) per the CVE record from GitHub_M, not the vendor checked 13 Nov
Score: CVSS 9.9 (critical). CVSS 3.1 9.9 (CNA GitHub_M) for CVE-2026-72868
Last checked: 13 Nov 2026, 16:26 UTC

Product	Affected	Version named	Source
Dokploy	before 0.29.13	0.29.13	CVE record (CNA) per the CVE record from GitHub_M, not the vendor checked 13 Nov

Sources: KEV – CVE record ✓ Vendor –

Sources

seclists.org: Dokploy: the validator allows the backtick — a member's database password change is host RCE, 9.9 on the vendor's own vector (v0.31.0, live-proven)

Follow on X

Totalone very hot coffee