CVE-2026-24841Disclosure(dokploy / dokploy)

LOWCVSS 9.9 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch dokploy dokploy systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint `/docker-container-terminal`. The `containerId` and `activeWay` parameters are directly interpolated into shell commands without sanitization, allowing authenticated attackers to execute arbitrary commands on the host server. Version 0.26.6 fixes the issue.

dokploy CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/Dokploy/dokploy/commit/74e0bd5fe3ef7199f44fcd19c6f5a2f09b806d6f

Exploit / PoC references

https://github.com/Dokploy/dokploy/security/advisories/GHSA-vx6x-6559-x35r

Other references

https://github.com/Dokploy/dokploy/blob/canary/apps/dokploy/server/wss/docker-container-terminal.ts

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

dokploy

Threat summary

Patch or workaround signal is available
6 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 6 signals
Disclosure: 5 classified signals
Peaked 2d ago at 4 mentions (2026-01-28); latest day: 1
6 total mentions across 3 days

Affected systems

Vendors

dokploy

Products

dokploy

Deep dive

Activity timeline6 mentions / 3d

Signal classification2 categories

Disclosure

583.3%

Patch

116.7%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-01-28	4	Disclosure4
2026-01-29	1	Patch1
2026-02-02	1	Disclosure1

Full discourse6 posts

CRAC Learning - Tech@cracbot248d
Disclosure
CVE-2026-24841 (CVSS:9.9, CRITICAL) is Undergoing Analysis. Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection..https://nvd.nist.gov/vuln/detail/CVE-2026-24841 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces the discovery and ongoing analysis of CVE-2026-24841, a critical command injection flaw in Dokploy prior to version 0.26.6, citing its high CVSS score and linking to the NVD entry.
0000047
171 followersView on X
PulsePatch.io@pulsepatchio252d
Patch
Dokploy contains an authenticated remote code execution vulnerability (CVE-2026-24841) via command injection in its Docker terminal. Update Dokploy to mitigate. #Dokploy #RCE #InfoSec https://www.pulsepatch.io/posts/cve-2026-24841-dokploy-authenticated-rce
Post summary
CVE‑2026‑24841 is an authenticated remote code execution vulnerability in Dokploy caused by command injection in the Docker terminal; users are urged to update the software to mitigate the risk.
0000074
1 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds253d
Disclosure
CVE-2026-24841 Command Injection Vulnerability in Dokploy WebSocket Endpoint Before 0.26.6 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-24841
Post summary
The text announces a command injection vulnerability in Dokploy’s WebSocket endpoint affecting versions prior to 0.26.6.
0000073
4.0K followersView on X
CVEFind.com@CveFindCom253d
Disclosure
[CVE-2026-24841: CRITICAL] Critical command injection vulnerability in Dokploy's WebSocket endpoint `/docker-container-terminal` prior to 0.26.6 allows authenticated attackers to execute arbitrary commands o...#cve,CVE-2026-24841,#cybersecurity https://cvefind.com/CVE-2026-24841
Post summary
The post alerts to a critical command injection flaw in Dokploy versions prior to 0.26.6 that permits authenticated attackers to run arbitrary commands through a WebSocket endpoint, but it does not provide a PoC, exploit code, patch, or evidence of active exploitation.
0000066
584 followersView on X
CVE@CVEnew254d
Disclosure
CVE-2026-24841 Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket e… https://www.cve.org/CVERecord?id=CVE-2026-24841
Post summary
Dokploy’s WebSocket interface contains a critical command injection flaw in versions earlier than 0.26.6; no PoC, exploit, patch, or active exploitation details are provided.
00000249
56.5K followersView on X
0day Signal@0dayPublishing254d
Disclosure
🚨 CVE-2026-24841: Dokploy Vulnerable to Authentica... Trivial command injection in Dokploy's WebSocket endpoint gives authenticated users full host server access - direct pa... https://zerodaysignal.com/vulnerability/CVE-2026-24841 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces CVE‑2026‑24841 as a trivial command injection in Dokploy’s WebSocket endpoint that allows authenticated users host‑level access; no PoC, exploit, or patch is referenced.
00000106
132 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	dokploy	dokploy	-	-	-

Explore more

Back to dashboard dokploy CVEs dokploy vulnerabilities

What researchers are saying

CVE-2026-24841

CRAC Learning - Tech@cracbotDisclosure

The post announces the discovery and ongoing analysis of CVE-2026-24841, a critical command injection flaw in Dokploy prior to version 0.26.6, citing its high CVSS score and linking to the NVD entry.

PulsePatch.io@pulsepatchioPatch

CVE‑2026‑24841 is an authenticated remote code execution vulnerability in Dokploy caused by command injection in the Docker terminal; users are urged to update the software to mitigate the risk.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The text announces a command injection vulnerability in Dokploy’s WebSocket endpoint affecting versions prior to 0.26.6.

CVEFind.com@CveFindComDisclosure

The post alerts to a critical command injection flaw in Dokploy versions prior to 0.26.6 that permits authenticated attackers to run arbitrary commands through a WebSocket endpoint, but it does not provide a PoC, exploit code, patch, or evidence of active exploitation.

CVE@CVEnewDisclosure

Dokploy’s WebSocket interface contains a critical command injection flaw in versions earlier than 0.26.6; no PoC, exploit, patch, or active exploitation details are provided.

0day Signal@0dayPublishingDisclosure

The tweet announces CVE‑2026‑24841 as a trivial command injection in Dokploy’s WebSocket endpoint that allows authenticated users host‑level access; no PoC, exploit, or patch is referenced.