# Dokploy vulnerabilities Source: https://junglewise.ai/threats/vendors/dokploy Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/dokploy.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 28 vulnerabilities in Dokploy: 1 in the last 7 days and 8 in the last 90 days, 19 of them critical and 0 exploited in the wild. The most recent, CVE-2026-127212, was published on 13 November 2026. 2 vulnerabilities in the last four weeks, level on the four before (2). 0 critical against 2. 1 technology has a page of its own. ## Counts - Last 7 days: 1 - Last 30 days: 3 - Last 90 days: 8 - All time: 28 (19 critical, 0 exploited in the wild) ## About Dokploy Dokploy is an open-source deployment tool used to manage applications and databases on servers. ## Latest Dokploy vulnerabilities - [CVE-2026-127212: Dokploy missing ownership check in application monitoring](https://junglewise.ai/threats/cve-2026-127212-dokploy-before-0-31-1-contains-a-missing-ownership-check) (medium, CVSS 4.3, published 13 Nov 2026) - [CVE-2026-116068: Dokploy authorization bypass in application management](https://junglewise.ai/threats/cve-2026-116068-dokploy-through-0-30-10-contains-an-authorization-bypass) (high, CVSS 8.8, published 25 Oct 2026) - [CVE-2026-111331: Dokploy cross-organization authorization bypass in port router](https://junglewise.ai/threats/cve-2026-111331-dokploy-through-0-30-8-contains-a-cross-organization) (medium, CVSS 6.3, published 15 Oct 2026) - [CVE-2026-93425: Dokploy OS command injection in patch repository read](https://junglewise.ai/threats/cve-2026-93425-dokploy-is-a-free-self-hostable-platform-as-a-service-paas-prior) (critical, CVSS 9.9, published 24 Sep 2026) - [CVE-2026-86059: Dokploy credential disclosure in provider APIs](https://junglewise.ai/threats/cve-2026-86059-dokploy-is-a-free-self-hostable-platform-as-a-service-paas-prior) (critical, CVSS 9.6, published 22 Sep 2026) - [CVE-2026-82954: Dokploy path traversal in Traefik configuration](https://junglewise.ai/threats/cve-2026-82954-dokploy-path-traversal-in-traefik-configuration) (critical, CVSS 9.9, published 31 Aug 2026) - [CVE-2026-45791: Dokploy session invalidation bypass in password change](https://junglewise.ai/threats/cve-2026-45791-dokploy-session-invalidation-bypass-in-password-change) (medium, CVSS 5.9, published 17 Aug 2026) - [CVE-2026-45790: Dokploy privilege escalation via organization.inviteMember](https://junglewise.ai/threats/cve-2026-45790-dokploy-privilege-escalation-via-organization-invitemember) (high, CVSS 8, published 17 Aug 2026) - [CVE-2026-72862: Dokploy OS command injection in database service deployments](https://junglewise.ai/threats/cve-2026-72862-dokploy-os-command-injection-in-database-service-deployments) (critical, CVSS 9.9, published 10 Aug 2026) - [CVE-2026-72740: Dokploy OS command injection in git clone deployment](https://junglewise.ai/threats/cve-2026-72740-dokploy-os-command-injection-in-git-clone-deployment) (critical, CVSS 9.9, published 10 Aug 2026) - [CVE-2026-72739: Dokploy command injection via compose name](https://junglewise.ai/threats/cve-2026-72739-dokploy-command-injection-via-compose-name) (medium, CVSS 6.5, published 10 Aug 2026) - [CVE-2026-72738: Dokploy backup.listBackupFiles command injection](https://junglewise.ai/threats/cve-2026-72738-dokploy-backup-listbackupfiles-command-injection) (critical, CVSS 9.9, published 10 Aug 2026) - [CVE-2026-72737: Dokploy backup cross-organization IDOR in destination handling](https://junglewise.ai/threats/cve-2026-72737-dokploy-backup-cross-organization-idor-in-destination-handling) (critical, CVSS 9.6, published 10 Aug 2026) - [CVE-2026-72736: Dokploy OS command injection in cluster and registry operations](https://junglewise.ai/threats/cve-2026-72736-dokploy-os-command-injection-in-cluster-and-registry-operations) (critical, CVSS 9.9, published 10 Aug 2026) - [CVE-2026-72735: Dokploy command injection in Traefik configuration](https://junglewise.ai/threats/cve-2026-72735-dokploy-command-injection-in-traefik-configuration) (critical, CVSS 9.9, published 10 Aug 2026) - [CVE-2026-72734: Dokploy server.remove authorization bypass](https://junglewise.ai/threats/cve-2026-72734-dokploy-server-remove-authorization-bypass) (high, CVSS 8.4, published 10 Aug 2026) - [CVE-2026-72733: Dokploy OS command injection in database backup/restore](https://junglewise.ai/threats/cve-2026-72733-dokploy-os-command-injection-in-database-backup-restore) (critical, CVSS 9.9, published 10 Aug 2026) - [CVE-2026-45661: Dokploy path traversal in application deployment](https://junglewise.ai/threats/cve-2026-45661-dokploy-path-traversal-in-application-deployment) (critical, CVSS 9.9, published 29 May 2026) - [CVE-2026-45633: Dokploy command injection in docker-container-logs WebSocket](https://junglewise.ai/threats/cve-2026-45633-dokploy-command-injection-in-docker-container-logs-websocket) (critical, CVSS 9.9, published 29 May 2026) - [CVE-2026-45632: Dokploy authorization bypass and RCE in schedule router](https://junglewise.ai/threats/cve-2026-45632-dokploy-authorization-bypass-and-rce-in-schedule-router) (critical, CVSS 9.9, published 29 May 2026) - [CVE-2026-45631: Dokploy hardcoded authentication secret allows admin takeover](https://junglewise.ai/threats/cve-2026-45631-dokploy-hardcoded-authentication-secret-allows-admin-takeover) (critical, CVSS 10, published 29 May 2026) - [CVE-2026-45630: Dokploy OS command injection in updateTraefikConfig](https://junglewise.ai/threats/cve-2026-45630-dokploy-os-command-injection-in-updatetraefikconfig) (critical, CVSS 9, published 29 May 2026) - [CVE-2026-45629: Dokploy OS command injection in listen-deployment WebSocket](https://junglewise.ai/threats/cve-2026-45629-dokploy-os-command-injection-in-listen-deployment-websocket) (critical, CVSS 9.9, published 29 May 2026) - [CVE-2026-45628: Dokploy command injection in deployment pipeline](https://junglewise.ai/threats/cve-2026-45628-dokploy-command-injection-in-deployment-pipeline) (critical, CVSS 9.6, published 29 May 2026) - [CVE-2026-43917: Dokploy cross-organization IDOR in multiple tRPC endpoints](https://junglewise.ai/threats/cve-2026-43917-dokploy-cross-organization-idor-in-multiple-trpc-endpoints) (info, CVSS 5.3, published 29 May 2026) ## Most severe Dokploy vulnerabilities - [CVE-2026-45631: Dokploy hardcoded authentication secret allows admin takeover](https://junglewise.ai/threats/cve-2026-45631-dokploy-hardcoded-authentication-secret-allows-admin-takeover) (critical, CVSS 10, published 29 May 2026) - [CVE-2026-82954: Dokploy path traversal in Traefik configuration](https://junglewise.ai/threats/cve-2026-82954-dokploy-path-traversal-in-traefik-configuration) (critical, CVSS 9.9, published 31 Aug 2026) - [CVE-2026-72735: Dokploy command injection in Traefik configuration](https://junglewise.ai/threats/cve-2026-72735-dokploy-command-injection-in-traefik-configuration) (critical, CVSS 9.9, published 10 Aug 2026) - [CVE-2026-72740: Dokploy OS command injection in git clone deployment](https://junglewise.ai/threats/cve-2026-72740-dokploy-os-command-injection-in-git-clone-deployment) (critical, CVSS 9.9, published 10 Aug 2026) - [CVE-2026-72738: Dokploy backup.listBackupFiles command injection](https://junglewise.ai/threats/cve-2026-72738-dokploy-backup-listbackupfiles-command-injection) (critical, CVSS 9.9, published 10 Aug 2026) - [CVE-2026-72733: Dokploy OS command injection in database backup/restore](https://junglewise.ai/threats/cve-2026-72733-dokploy-os-command-injection-in-database-backup-restore) (critical, CVSS 9.9, published 10 Aug 2026) - [CVE-2026-72862: Dokploy OS command injection in database service deployments](https://junglewise.ai/threats/cve-2026-72862-dokploy-os-command-injection-in-database-service-deployments) (critical, CVSS 9.9, published 10 Aug 2026) - [CVE-2026-72736: Dokploy OS command injection in cluster and registry operations](https://junglewise.ai/threats/cve-2026-72736-dokploy-os-command-injection-in-cluster-and-registry-operations) (critical, CVSS 9.9, published 10 Aug 2026) - [CVE-2026-93425: Dokploy OS command injection in patch repository read](https://junglewise.ai/threats/cve-2026-93425-dokploy-is-a-free-self-hostable-platform-as-a-service-paas-prior) (critical, CVSS 9.9, published 24 Sep 2026) - [CVE-2026-45661: Dokploy path traversal in application deployment](https://junglewise.ai/threats/cve-2026-45661-dokploy-path-traversal-in-application-deployment) (critical, CVSS 9.9, published 29 May 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, level on the four before (2). 0 critical against 2. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 2 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 1 | 1 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 2 | 2 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 1 | 0 | 0 | ## Dokploy technologies - [Dokploy](https://junglewise.ai/threats/technologies/dokploy): 28 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Dokploy vulnerabilities", https://junglewise.ai/threats/vendors/dokploy, 13 November 2026.