Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-72902, describes an authenticated remote code execution (RCE) flaw in Dokploy. The core issue lies in the registry.testRegistry and registry.testRegistryById functions within apps/dokploy/server/api/routers/registry.ts. These functions were designed to test registry connections, and critically, they used execAsyncRemote to execute shell commands on a local or SSH-connected target server.
The vulnerability stemmed from the insecure construction of the shell command. Specifically, the password field (either input.password or registryData.password) was directly interpolated into the command string using backticks (`), like so: `echo ${password} | docker ${args.join(" ")}`. This direct interpolation, without proper escaping or sanitization, allowed an authenticated attacker to inject arbitrary shell commands. For example, if an attacker provided a password like pw; whoami, the whoami command would be executed on the target server, leading to RCE.
The provided patch (commit d3f522b7a6f5100fc0fc0bff5851e48d11d459e2) addresses this by replacing the insecure command string interpolation with a call to safeDockerLoginCommand. This new function correctly handles the password by passing it via --password-stdin and properly escaping other fields, thereby preventing command injection. The vulnerable functions are registryRouter.testRegistry and registryRouter.testRegistryById as they existed before this patch, as they contained the direct interpolation of user-controlled input into a shell command.
registryRouter.testRegistryapps/dokploy/server/api/routers/registry.ts
registryRouter.testRegistryByIdapps/dokploy/server/api/routers/registry.ts