CVE-2026-24841 is a critical (CVSS 9.9) command injection in the /docker-container-terminal WebSocket endpoint of Dokploy, the self-hosted PaaS. Authenticated users can run commands on the host server. Versions before 0.26.6 are affected. Upgrade to 0.26.6 or later, then review accounts and host logs.
What's affected
The record says Dokploy versions before 0.26.6 are affected, and 0.26.6 fixes the issue. The advisory's metadata shows the patched version as v0.26.6.
The containerId and activeWay parameters of the terminal WebSocket endpoint are interpolated into shell commands without sanitizing. An authenticated attacker can therefore run arbitrary commands on the host server. The CVSS vector needs low privileges and has a changed scope, which reflects the jump from the app to the host.
How to check if you're exposed
Check the Dokploy version in the dashboard, or in the version of the image you deployed. Anything older than 0.26.6 is in range.
Then list who has accounts. Any authenticated user can reach the endpoint, so shared instances with several teams or external collaborators carry the most risk. Review the host's shell history and process logs for commands you do not recognize.
For a quick look at your own dependencies, Safeguard's free in-browser dependency scan at https://gold.safeguard.sh/scan checks them against known CVEs in your browser.
What to do now
- Upgrade Dokploy to 0.26.6 or later.
- Review all Dokploy user accounts and remove those no longer needed.
- If an old version was exposed to many users, treat the host as possibly compromised and rotate secrets stored on it.
- Do not expose the Dokploy panel to the internet without an access control layer such as a VPN.
- Keep backups off the Dokploy host.
Why it matters
The weakness is CWE-78, OS command injection. The code builds a shell command by concatenating request parameters, so characters in those parameters can change the command. The cure is to avoid the shell, pass arguments as a list, and validate identifiers against a strict pattern.
A deployment platform holds the keys to everything it deploys, so a host level flaw reaches registry credentials, environment secrets and every app. The CVE is not in CISA's Known Exploited Vulnerabilities catalog.
What a host level flaw in a deployment tool means
Dokploy is the kind of tool that sits at the center of a small team's infrastructure. It builds, deploys and restarts applications, and so it holds registry credentials, environment variables and access to the Docker daemon. A command injection that reaches the host, rather than a single container, therefore has a wide blast radius, and the CVSS scope marked as changed reflects that.
The advisory points at two request parameters, containerId and activeWay, that were placed into shell commands without checks. The same code path serves a terminal into a container, which is a feature users expect to use. The lesson is about how such features should be built: pass identifiers to the Docker API as arguments, never inside a shell string, and validate them against the format they are supposed to have, for example a hexadecimal ID or a known name.
If an old version was reachable
Work out who could log in. The flaw needs an authenticated user, so a panel with one admin account is a different case from a panel shared with contractors. If the panel was reachable from the internet and had accounts you cannot fully account for, treat the host as possibly compromised. Check the host's process history and any new users, cron entries, SSH keys and containers. Rotate the secrets stored in Dokploy, registry tokens and database passwords first.
Reduce what the panel can reach
Put the panel behind a VPN or an identity aware proxy, so that the login page is not on the open internet. Give users the least role that does their work. Keep backups and secrets managers off the same host, so that a compromise of the deployment tool does not take your recovery path with it.
Keep an inventory
Self-hosted tools like this are installed once and forgotten. List every one you run, with the version and the owner, and check that list when a new advisory lands. Continuous monitoring of that inventory, as the demo below shows, turns a week of discovery into a quick lookup.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does an attacker need an account?
Yes, the advisory describes authenticated attackers, though a low privilege account is enough.
Which version fixes it?
Dokploy 0.26.6.
Sources
Last reviewed: 19 October 2026.
