CVE-2026-45630 Dokploy: Authenticated Remote Code Execution via Command Injection in updateTraefikConfig Echo Statement
Authenticated admin users can execute arbitrary system commands on remote servers via unsanitized input in the Traefik configuration update endpoint.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45630?
CVE-2026-45630 is a critical command injection vulnerability in dokploy, published on 29 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, authenticated OS command injection in the application.updateTraefikConfig tRPC endpoint allows admin/owner users to execute arbitrary system commands on remote servers via unsanitized echo shell interpolation.
Weakness: CWE-78
Which versions are affected by CVE-2026-45630?
How do I fix CVE-2026-45630?
No fix has been published for CVE-2026-45630 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-45630 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45630 exists.
Sources
Also known as GHSA-p787-6gqg-cvp5.