CVE-2026-24841

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint `/docker-container-terminal`. The `containerId` and `activeWay` parameters are directly interpolated into shell commands without sanitization, allowing authenticated attackers to execute arbitrary commands on the host server. Version 0.26.6 fixes the issue.

• CWE-78

• https://github.com/Dokploy/dokploy/blob/canary/apps/dokploy/server/wss/docker-container-terminal.tsProduct
• https://github.com/Dokploy/dokploy/commit/74e0bd5fe3ef7199f44fcd19c6f5a2f09b806d6fPatch
• https://github.com/Dokploy/dokploy/security/advisories/GHSA-vx6x-6559-x35rExploit, Mitigation, Vendor Advisory

Published

Jan 28, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24836DNN (formerly DotNetNuke) is an open-source web content mana…5.4
• CVE-2026-24837DNN (formerly DotNetNuke) is an open-source web content mana…5.4
• CVE-2026-24838DNN (formerly DotNetNuke) is an open-source web content mana…5.4
• CVE-2026-24839Dokploy is a free, self-hostable Platform as a Service (PaaS…6.1
• CVE-2026-2484IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 …4.3
• CVE-2026-24840Dokploy is a free, self-hostable Platform as a Service (PaaS…8.8
• CVE-2026-24842node-tar,a Tar for Node.js, contains a vulnerability in vers…8.2
• CVE-2026-24843melange allows users to build apk packages using declarative…8.4
• CVE-2026-24844melange allows users to build apk packages using declarative…8.8
• CVE-2026-24845malcontent discovers supply-chain compromises through. conte…6.5
• CVE-2026-24846malcontent discovers supply-chain compromises through. conte…5
• CVE-2026-24847OpenEMR is a free and open source electronic health records …6.1