Is CVE-2026-45631 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45631 being exploited in the wild.

How severe is CVE-2026-45631?

Critical severity, with a CVSS score of 10, published 29 May 2026.

Is there a fix for CVE-2026-45631?

A patch was published on 2026-05-09: Fix merged into canary branch via Pull Request 4374 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45631 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-45631?

Check whether you run Dokploy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45631: Dokploy hardcoded authentication secret allows admin takeover

CVE-2026-45631 · Severity: critical · CVSS 10 · Published 2026-05-29

Dokploy, a self-hostable platform for managing applications and databases, contains a security flaw where it uses a publicly known, hardcoded secret key for authentication. An unauthenticated attacker can use this known secret to forge digital signatures, allowing them to log in as an administrator without a password. Once logged in, the attacker has full control over the server, including the ability to steal sensitive data, access stored credentials, and execute arbitrary commands on the underlying host system.

Technologies: Dokploy. Vendors: Dokploy.

Quick answers

Is CVE-2026-45631 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45631 being exploited in the wild.
How severe is CVE-2026-45631?: Critical severity, with a CVSS score of 10, published 29 May 2026.
Which products and versions are affected?: Dokploy 0.27.0 to 0.29.2.
Is there a fix for CVE-2026-45631?: A patch was published on 2026-05-09: Fix merged into canary branch via Pull Request 4374 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45631 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45631?: Check whether you run Dokploy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Dokploy (versions 0.27.0 to 0.29.2) contains a hardcoded fallback value for the 'BETTER_AUTH_SECRET' environment variable in its server constants. Because the default installation script does not generate a unique secret, many self-hosted instances use the default string 'better-auth-secret-123456789'. An unauthenticated attacker can exploit this by forging HS256-signed JSON Web Tokens (JWTs) for the '/api/auth/verify-email' endpoint. Successful verification triggers an automatic administrative session creation due to the 'autoSignInAfterVerification' configuration. This grants the attacker full admin access, which includes the ability to execute commands on the host via the integrated SSH terminal. The issue is resolved in version 0.29.3 by removing the hardcoded fallback and implementing unique secret generation during setup.

Affected products

Dokploy Dokploy 0.27.0 to 0.29.2

Timeline

2026-05-09: patched: Fix merged into canary branch via Pull Request 4374
2026-05-11: advisory: GitHub Security Advisory GHSA-w3gm-rc4p-9rhj published
2026-05-29: disclosed: CVE-2026-45631 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.