Vulnerabilidades en Dokploy
57 resultadosAnálisis Vexday
Dokploy apresenta um panorama de risco significativo com 18 vulnerabilidades registradas, sendo 11 críticas (CVSS ≥9.0) e 11 publicadas nos últimos 90 dias, indicando um padrão recente de descobertas. Embora nenhuma esteja sob exploração ativa documentada (KEV), a predominância de injeção de comando (CWE-78) representa um vetor de ataque direto e de alto impacto que demanda remediação prioritária. A concentração de críticas em período recente sugere questões estruturais na base de código que merecem revisão urgente.
CVE-2026-45631CRITICALDokploy: Pre-Auth Admin Takeover via Hardcoded Authentication SecretEPSS 0.7%CVE-2026-72881MEDIUMDokploy: Command Injection via database credentials in backup/restore commandsEPSS 0.7%CVE-2026-72872CRITICALDokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone`EPSS 0.7%CVE-2026-72869CRITICALDokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCEEPSS 0.7%CVE-2026-72865CRITICALDokploy: OS Command Injection via compose `composePath`EPSS 0.7%CVE-2026-72739MEDIUMDokploy: Command Injection via Compose Shell ExecutionEPSS 0.6%CVE-2026-72862CRITICALDokploy: OS Command Injection via dockerImage field in database service deployment functions → HOST RCEEPSS 0.6%CVE-2026-72736CRITICALDokploy: OS Command Injection in registry credential testing and Swarm cluster management → HOST RCEEPSS 0.6%CVE-2026-93425CRITICALDokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as rootEPSS 0.6%CVE-2026-72884HIGHDokploy: Command Injection via Compose Custom CommandEPSS 0.6%CVE-2026-72877CRITICALDokploy: Command Injection via dockerImage in buildRemoteDockerEPSS 0.6%CVE-2026-72866HIGHWebSocket Terminal Auth BypassEPSS 0.6%CVE-2026-72883HIGHDokploy: WebSocket Terminal Missing Service-Level Access ControlEPSS 0.6%CVE-2026-72863CRITICALDokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker hostEPSS 0.6%CVE-2025-53825CRITICALDokploy's Preview Deployments are vulnerable to Remote Code ExecutionEPSS 0.5%CVE-2026-72886CRITICALDokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of CVE-2026-45632)EPSS 0.5%CVE-2026-72882CRITICALDokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed serversEPSS 0.5%CVE-2026-72864CRITICALDokploy Broken Access Control on docker-container-terminal WebSocket (Member -> Root in Arbitrary Containers)EPSS 0.5%CVE-2026-72871HIGHDokploy: Unauthenticated Git Provider Injection via GitHub OAuth CallbackEPSS 0.5%CVE-2026-86059CRITICALDokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.oneEPSS 0.5%