CVE-2026-24840 HIGH

CVE-2026-24840: Dokploy uses hardcoded credentials in installation script, which could result in database access

Vendor Dokploy

Product dokploy

Weakness CWE-798 · Hardcoded credentials

Published January 28, 2026

Last update January 28, 2026

View on NVD All CVEs

CVSS base score

8.0/10

Attack vector Adjacent

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a hardcoded credential in the provided installation script (located at https://dokploy.com/install.sh, line 154) uses a hardcoded password when creating the database container. This means that nearly all Dokploy installations use the same database credentials and could be compromised. Version 0.26.6 contains a patch for the issue.

Key dates

02Disclosure timeline

January 28, 2026 CVE published

January 28, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-24840 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/798.html