CVE-2026-45662: Dokploy Command Injection in Registry Deletion (CVSS 8.8)

Technical summary

The vulnerability exists in the deleteRegistry function within packages/server/src/services/registry.ts. The function constructs and executes a docker logout command using an unsanitized registryUrl parameter: docker logout ${response.registryUrl}. The same codebase correctly applies shEscape() to the docker login command, demonstrating that the developers were aware of the command injection risk but failed to apply the same protection consistently to the logout operation. This inconsistency allows shell metacharacters and command separators in the registryUrl to break out of the intended command context and execute arbitrary system commands. The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Business impact

Successful exploitation requires an authenticated user with registry management permissions, limiting the attack surface to insider threats or compromised admin accounts. However, the impact is severe: an attacker could gain arbitrary code execution on the Dokploy host with full system access. This could lead to deployment of malicious container images, exfiltration of sensitive data including credentials stored within Dokploy, lateral movement to other infrastructure, or complete compromise of hosted applications. Organizations running Dokploy as a critical deployment platform face significant operational and security risk until patching is complete.

Affected systems

Dokploy versions 0.29.0 and earlier are affected. The vulnerability is present in the server-side registry management code, so any deployment of these versions where administrators or users with registry deletion privileges exist is at risk. Self-hosted Dokploy instances are the primary concern; exposure is limited to users with platform access and registry management capabilities.

Exploitability

Exploitation requires authenticated access to Dokploy with sufficient permissions to delete a registry—a moderately restrictive precondition. However, the actual exploitation itself is straightforward: an attacker need only provide a crafted URL when deleting a registry. No advanced techniques, TOCTOU conditions, or race conditions are required. The attack vector is network-based, and the complexity is low once access is obtained. The CVSS 3.1 score of 8.8 (HIGH) reflects the combination of high impact and the relatively low barrier to exploitation for an authenticated user.

Remediation

Upgrade Dokploy to a patched version that applies proper shell escaping to the registryUrl parameter in the deleteRegistry function, consistent with how the docker login command is already handled. Verify the patch version in the official Dokploy release notes. Until patching is possible, restrict registry deletion permissions to a minimal set of trusted administrators and monitor command execution logs on the Dokploy host for suspicious activity during registry management operations.

Patch guidance

Monitor the Dokploy project repository and release notes for a patched version addressing this vulnerability. When available, update to the first version after 0.29.0 that includes the fix. Apply the patch during a maintenance window and verify that registry operations continue to function correctly post-update. Test with non-production registries first if possible.

Detection guidance

Monitor system audit logs and container runtime logs on Dokploy hosts for unexpected command execution originating from the Dokploy process during registry deletion operations. Look for shell metacharacters (backticks, $(), semicolons, pipes) in registry URLs stored in Dokploy configuration or logs. Check for any docker logout commands followed by unauthorized process execution. If available, enable application-level logging within Dokploy to capture registry operation parameters.

Why prioritize this

Although exploitation requires authentication, the high impact (complete system compromise), low attack complexity, and the presence of a clear, fixable coding error make this a high-priority patch. Organizations should prioritize this update within their standard patch cycle, particularly if Dokploy instances are used to manage production deployments or handle sensitive credentials.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: network-based attack vector (AV:N), low attack complexity (AC:L), requirement for low privileges (PR:L), no user interaction needed (UI:N), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The score appropriately captures the severity of arbitrary code execution on the Dokploy server, tempered slightly by the authentication requirement.

Frequently asked questions