CVE-2026-45662 HIGH

CVE-2026-45662: Dokploy: Command Injection via incomplete shell escaping in docker logout (registry deletion)

Vendor Dokploy
Product dokploy
Weakness CWE-78
Published May 29, 2026
Last update June 2, 2026

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.0 and earlier, the deleteRegistry function in Dokploy (packages/server/src/services/registry.ts) executes docker logout ${response.registryUrl} without shell escaping. In the same file, the docker login command correctly uses shEscape() to prevent command injection. This inconsistency creates a command injection vulnerability when deleting a registry with a crafted registryUrl.

Key dates

02Disclosure timeline

May 29, 2026 CVE published
June 2, 2026 Record updated