Dokploy: Command injection as host root by a member role via destination.testConnection

An account with the member role that was invited into an organization sends a single request to destination.testConnection, breaks out of an rclone command with a double quote and, through the mounted Docker socket, runs arbitrary commands as root on the host.

Advisory ID: TP-2026-039
Product: Dokploy (Self-hosted open-source PaaS that manages deployments through Docker Swarm and Traefik)
Vulnerability type: OS command injection and missing authorization (CWE-78, CWE-862)
CVE: CVE-2026-72868
CVSS 3.1: 9.9 (Critical) · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vendor advisory: GHSA-f6x8-vfwh-8hjr
Affected versions: <= 0.29.12
Fixed in: 0.29.13
Reported: 18 May 2026

Summary

Dokploy is a self-hosted PaaS that manages the deployments of several organizations through Docker Swarm and Traefik. The tRPC mutation destination.testConnection assembles an rclone command from the user-supplied S3 fields and passes it to a shell without escaping the values, so a double quote breaks out of the string literal and appends arbitrary commands. The endpoint is meant for the role allowed to manage destinations, yet the central permission check skips the actual authorization for accounts holding the member role. Because the service runs as uid 0 and mounts the host's Docker socket, a single authenticated request from an ordinary member account leads to arbitrary code execution as root on the host and thereby to the compromise of every organization on the same installation. turingpoint verified the chain end to end and reported it to the vendor, who fixed it in 0.29.13.

Root cause

destination.testConnection builds an rclone command by interpolating the fields accessKey, secretAccessKey, region, endpoint, provider and bucket into a template string and passing it through execAsync to child_process.exec (apps/dokploy/server/api/routers/destination.ts:47-93). The values are wrapped in double quotes but never escaped, so a " closes the literal and the shell runs the remainder of the input as commands. The endpoint carries withPermission("destination", "create"), and the member role explicitly holds an empty rights array for that resource (packages/server/src/lib/access-control.ts), yet the check is bypassed. checkPermission returns early without calling role.authorize() whenever every requested resource is enterprise-only, and this return path also applies to the member role instead of only owner and admin (packages/server/src/services/permission.ts:84-89). The default Docker image and install.sh start the service as uid 0 and bind-mount the host socket /var/run/docker.sock, so a command injected by a member runs as root and reaches the host through the Docker socket.

Proof of Concept

Schematically:

# Bob was invited into the organization as a member and signs in.
POST /api/trpc/destination.testConnection?batch=1
Content-Type: application/json
Origin: https://<host>

{"0":{"json":{"name":"x","provider":"S3","region":"us-east-1",
  "endpoint":"https://s3.amazonaws.com","bucket":"b","secretAccessKey":"s",
  "accessKey":"X\";<command>; echo \""}}}

The value in accessKey closes the quoted rclone flag and makes the shell run <command> as uid 0 inside the Dokploy container. Because the container mounts the host's Docker socket, the injected command can start a further container with the host filesystem mounted and gain root on the host; turingpoint confirmed this chain live up to a file written as root on the host.

Impact

  • Arbitrary operating-system commands as uid 0 inside the Dokploy container, triggered by a single authenticated request from an account with the member role.
  • Takeover of the host system as root through the Docker socket mounted into the container.
  • Access to the deployments and plaintext secrets of every other organization on the same Dokploy installation.
  • No audit record on the free tier, because audit logging is reserved for the enterprise tier.

References

Is Something Like This in Your Software?

Our team found this vulnerability in the course of its work. Have your applications reviewed by the same specialists, with a penetration test from turingpoint.

Request a Pentest