CVE-2026-45630

Vulnerability

In Dokploy versions 0.28.8 and earlier, the application.updateTraefikConfig tRPC endpoint accepts a traefikConfig input as a plain z.string() with no regex or character restrictions [1]. This value flows to the writeConfigRemote() function in packages/server/src/utils/traefik/application.ts, which interpolates it into a shell echo command wrapped in single quotes: echo '${traefikConfig}' > ${configPath} [1]. The affected code paths are in apps/dokploy/server/api/routers/application.ts (lines 851-873) and the utility function (lines 213-222) [1]. The endpoint is accessible only to admin or owner users.

Exploitation

An attacker with an admin or owner account on the target Dokploy instance and an application deployed on a server with an SSH key configured can exploit this vulnerability [1]. By sending a crafted tRPC mutation to application.updateTraefikConfig with a traefikConfig value containing a single quote ('), the attacker breaks out of the shell quoting context and injects arbitrary shell commands [1]. The advisory provides a concrete curl example that demonstrates the injection [1].

Impact

Successful exploitation allows the attacker to execute arbitrary OS commands on the remote server where the application is deployed [1]. This results in full compromise of that server, including potential data exfiltration, lateral movement within the infrastructure, and further privilege escalation depending on the SSH user's permissions [1].

Mitigation

As of the advisory publication date (2026-05-29), no patched version of Dokploy has been released [1]. Users should restrict admin and owner account access to trusted personnel only and monitor the project repository for a security update [1]. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog at the time of writing.