# Dokploy: the validator allows the backtick — a member's database password change is host RCE, 9.9 on the vendor's own vector (v0.31.0, live-proven)

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/620) · 2026-11-10 · Security
Page: https://themorning.dev/story/dokploy-the-validator-allows-the-backtick-a-member-s-database-password-change-is-171642f4d02fcce4
Kind: security · Impact: high

## In brief

- Dokploy's input validator allows a backtick character when a member changes a database password.
- The source reports that this lets a member achieve remote code execution on the host, scored 9.9 on the vendor's own vector.
- The issue was demonstrated live on v0.31.0 and posted to oss-sec on Nov 9.

## Why it matters

Dokploy holds root on every managed server, the Docker socket, and the credentials of deployed databases and applications, so host RCE from a low-privilege member can compromise the whole fleet.

## Versions

- Dokploy v0.31.0

## Timeline

- 2026-11-09: Vulnerability posted to oss-sec by theknell

## Coverage

- [Dokploy: the validator allows the backtick — a member's database password change is host RCE, 9.9 on the vendor's own vector (v0.31.0, live-proven)](https://seclists.org/oss-sec/2026/q4/620) — Open Source Security, 2026-11-10

Tags: security, rce, dokploy, input-validation, self-hosted, docker

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev