CVE-2026-24841

CRITICAL

dokploy < 0.26.6 - Authenticated OS Command Injection via WebSocket Endpoint Parameters

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-24841. PoCs published by XiaomingX, otakuliu.

AI-analyzed exploit summary This repository contains a functional proof-of-concept for CVE-2026-24841, simulating a vulnerable Dokploy WS Terminal environment. It strictly enforces session authentication and mimics command execution behavior for testing purposes.

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint `/docker-container-terminal`. The `containerId` and `activeWay` parameters are directly interpolated into shell commands without sanitization, allowing authenticated attackers to execute arbitrary commands on the host server. Version 0.26.6 fixes the issue.

Exploits (2)

github WORKING POC 10 stars
by XiaomingX · pythonpoc
https://github.com/XiaomingX/data-cve-poc-py-v1/tree/main/2026/CVE-2026-24841

This repository contains a functional proof-of-concept for CVE-2026-24841, simulating a vulnerable Dokploy WS Terminal environment. It strictly enforces session authentication and mimics command execution behavior for testing purposes.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Dokploy WS Terminal
Auth required
Prerequisites: Valid session cookie (session=demo) · WebSocket connection to the target endpoint
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC
by otakuliu · poc
https://github.com/otakuliu/CVE-2026-24841_Range

This is a safe simulator for CVE-2026-24841, designed to validate the official PoC by mimicking the vulnerable Dokploy WS Terminal behavior. It enforces strict session authentication (session=demo) and simulates command execution without actual system commands.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Dokploy WS Terminal
Auth required
Prerequisites: Valid session cookie (session=demo) · WebSocket connection to the target endpoint
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 9.9
EPSS 0.0013
EPSS Percentile 32.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (1)
dokploy/dokploy < 0.26.6
Published Jan 28, 2026
Tracked Since Feb 18, 2026