CVE-2026-129433 · Other
NO FIX YET · SEE WHAT TO DO
Dokploy, a self-hosted deployment platform, passes a stored serviceName value to a shell in getComposeContainerCommand(), so shell metacharacters run as commands. An authenticated organization member can trigger this through backup settings, and scheduled backups execute the commands as root, which can take over the host through the mounted Docker socket.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host Dokploy below 0.31.1, where organization members can edit backup settings. Exposure depends on backup schedules running and the Docker socket being mounted into the Dokploy container, which is the default setup for that platform. Instances on 0.31.1 or later, or where only trusted administrators can reach backup settings, have a much smaller exposure.
Not affected if managed-hosting, version-0.31.1-or-later
Who cares backups, docker, dokploy, self-hosted
dokploy --version or the image tag in your compose file, and confirm whether it is below 0.31.1.;, |, $(, or backticks.0.31.1 or later.Dokploy before 0.31.1 contains an OS command injection vulnerability in getComposeContainerCommand() that allows authenticated organization members to execute shell commands via the serviceName parameter. Attackers can store serviceName values with shell metacharacters through backup.create or backup.update tRPC procedures, executing commands as root when scheduled backups run and taking over the host via the mounted Docker socket.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.