Vulnerability · critical · CVSS 9.9
Dokploy validator flaw allows host RCE via database password change
Tier B · Patch this week – Put it in the sprint
Who’s exposed: Self-hosted Dokploy instances where members can change database passwords
Tier B because: Full takeover OR secrets exposed OR supply chain
Reach
Attack
Damage
Fix
Full takeover
The Brief
- Dokploy's input validator allows a backtick character when a member changes a database password.
- The source reports that this lets a member achieve remote code execution on the host, scored 9.9 on the vendor's own vector.
- The issue was demonstrated live on v0.31.0 and posted to oss-sec on Nov 9.
Why it matters
Dokploy holds root on every managed server, the Docker socket, and the credentials of deployed databases and applications, so host RCE from a low-privilege member can compromise the whole fleet.
The checklist behind the tier
Checklist · 2 of 10 yes
| Yes | Hits tech teams | Self-hosted deployment panel that ops teams run to manage servers, Docker and databases. |
| No | Core infrastructure | Single self-hosted panel product, not software nearly every team runs. |
| No | Popular tool | Dokploy has about 38,000 GitHub stars, but it is a single niche self-hosting product. |
| No | Exploited in the wild | oss-sec post reports a researcher live-proof of RCE; no observed attacks reported. |
| No | Public exploit | oss-sec post says live-proven; no source says exploit code or PoC is published. |
| No | Remote, no login | oss-sec post says a member's database password change leads to RCE, so an account is needed. |
| Yes | Full takeover | oss-sec post (Open Source Security, 2026-11-10): database password change is host RCE, rated 9.9. |
| No | Secrets exposed | oss-sec post describes the risk but reports no stolen or exposed credentials. |
| No | Supply chain | oss-sec post describes a validator flaw, not compromised packages, builds or signing keys. |
| No | No fix yet | oss-sec post names v0.31.0 as affected but does not state whether a patch exists. |
Timeline
Vulnerability posted to oss-sec by theknell
Open Source Security
Dokploy: the validator allows the backtick — a member's database password change is host RCE, 9.9 on the vendor's own vector (v0.31.0, live-proven)
Source
Dokploy: the validator allows the backtick — a member's database password change is host RCE, 9.9 on the vendor's own vector (v0.31.0, live-proven) ↗ Open Source Security · 3h ago
First seen · 1 source · Full story page · How tiers are decided