[{"data":1,"prerenderedAt":221},["ShallowReactive",2],{"seo-verification":3,"blog-dokploy-cve-2026-critical-update-0-29-13-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-dokploy-cve-2026-critical-update-0-29-13-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":33,"intro":36,"sections":37,"ctaTitle":122,"ctaBody":123,"ctaButton":124,"ctaUrl":125,"relatedPosts":126},379,"dokploy-cve-2026-critical-update-0-29-13",{"fr":12,"en":10,"ar":13,"es":14},"dokploy-cves-2026-mise-a-jour-critique","dokploy-cve-2026-تحديث-عاجل-إلى-0-29-13","dokploy-cve-2026-actualizacion-critica-a-0-29-13","Dokploy CVE-2026: Critical Update to 0.29.13","Two CVSS 10.0 and 9.9 CVEs in Dokploy chain together: forgeable admin JWT without an account + root shell via WebSocket. Patch guide to ≥ 0.29.13.",11,0,false,"2026-09-25T00:00:00+00:00","2026-09-25T23:43:02+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fdokploy-cves-2026-mise-a-jour-critique-poster.svg",{"categorySlug":34,"appSlug":35},"application-deployment-devops","dokploy","GitHub advisories GHSA-w3gm-rc4p-9rhj and GHSA-7r6p-v9gw-pwc8, published on September 25, 2026, expose an unprecedented attack scenario on Dokploy: a JWT secret hardcoded in the source code since version 0.27.0 allows any attacker to forge a valid admin token without any account, and unauthorized WebSocket handlers then turn that token into a root shell on the host. Any Dokploy instance below 0.29.13 is compromised from any network, with no interaction required. The fix takes two commands and one secret rotation.",[38,42,45,49,52,55,82,85,107,110,113,116,119],{"type":39,"title":40,"body":41},"h2","Two critical CVEs, one complete exploit chain","On September 25, 2026, two security advisories were published simultaneously for Dokploy, the self-hosted deployment tool that competes with Heroku and Render. The combination of the two constitutes the most severe threat to hit the self-hosted PaaS ecosystem in 2026: no account required, root on the host in under a minute, and every instance below version 0.29.13 is exposed.\n\nCVE-2026-45631 (CVSS 10.0) concerns a JWT secret hardcoded in the source code. CVE-2026-72863 (CVSS 9.9) concerns WebSocket handlers that authenticate without authorizing. Taken separately, each is already critical. Chained together, they form a complete attack: the first provides administrative identity, the second provides execution.",{"type":39,"title":43,"body":44},"CVE-2026-45631 (CVSS 10.0): the hardcoded JWT secret","GitHub advisory GHSA-w3gm-rc4p-9rhj describes a CWE-798 vulnerability — use of hardcoded credentials. Dokploy uses the `better-auth` library for session and JWT token management. In versions 0.27.0 through 0.29.2 inclusive, the default value for the `BETTER_AUTH_SECRET` variable was left as `better-auth-secret-123456789` in the publicly published source code.\n\nThis value is what signs all Dokploy administration JWT tokens. Anyone who knows it — and it has been public since the first commit of version 0.27.0 — can forge a valid JWT token with administrator rights, without holding any account on the target instance. Dokploy's admin API then accepts all requests: reading all deployment secrets, executing commands via the API, modifying service configurations.\n\nA CVSS score of 10.0 is the absolute maximum. It reflects the complete absence of any barrier: the attack vector is network, no user interaction is required, no prior authentication is needed, and the confidentiality, integrity, and availability of the host are all compromised.",{"type":46,"title":47,"body":48},"tip","Check if your instance is exposed to CVE-2026-45631","On the Dokploy host, run: `grep BETTER_AUTH_SECRET \u002Fetc\u002Fdokploy\u002F.env`\n\nIf the displayed value is `better-auth-secret-123456789`, if the variable is absent from the file, or if the `.env` file predates version 0.29.3 without having been regenerated: your instance is exposed. The binary version alone is not sufficient — an update without secret rotation leaves the old value in place.",{"type":39,"title":50,"body":51},"CVE-2026-72863 (CVSS 9.9): escalation via WebSocket terminals","GitHub advisory GHSA-7r6p-v9gw-pwc8 describes insufficient access control on WebSocket handlers exposing Dokploy's Docker terminals. The vulnerability is class CWE-285 — improper authorization.\n\nDokploy allows each user to access an interactive terminal in their containers via WebSocket. The check in place authenticated the user — it confirmed the presence of a valid token — but did not authorize: it did not verify that the requested service actually belongs to the requesting user. Any user with a valid account, even without administrative rights, could therefore open a terminal in any container belonging to any other user.\n\nThe actual impact goes beyond the container itself. Dokploy runs as root and mounts the host Docker socket (`\u002Fvar\u002Frun\u002Fdocker.sock`). From a shell inside a container, the command `docker run --rm -v \u002F:\u002Fhost alpine chroot \u002Fhost sh` yields a root shell on the host filesystem. All versions below 0.29.13 are affected.",{"type":39,"title":53,"body":54},"The complete attack scenario: from zero access to root","The CVE-2026-45631 + CVE-2026-72863 chain constitutes a complete attack achievable from any network, without a pre-existing account, in two steps.\n\n**Step 1 — Forge an admin token (CVE-2026-45631).** The attacker knows the value `better-auth-secret-123456789` from the public source code. They generate a JWT signed with this value, claiming the admin role. Dokploy's API accepts this token without further verification. The attacker now has full administrative access: list of all services, environment secrets, deployment keys.\n\n**Step 2 — Access a container terminal (CVE-2026-72863).** With the forged admin token, the attacker opens a WebSocket connection to an arbitrary container's terminal. The absent authorization check lets the request through. The attacker has a shell inside the container.\n\n**Result — Root on the host.** With Dokploy running as root with the Docker socket mounted, the attacker pivots from the container to the host. The entire filesystem, secrets from all hosted projects, SSH keys, and production environment variables are accessible. The entire operation requires no operator interaction and no pre-existing account on the instance.",{"type":56,"title":57,"headers":58,"rows":64},"comparison","Versions and patch matrix",[59,60,61,62,63],"CVE","CVSS","Affected versions","Fixed version","Required action",[65,71,77],[66,67,68,69,70],"CVE-2026-45631","10.0 — CRITICAL","0.27.0 – 0.29.2","≥ 0.29.3","Update + regenerate BETTER_AUTH_SECRET",[72,73,74,75,76],"CVE-2026-72863","9.9 — CRITICAL","\u003C 0.29.13","≥ 0.29.13","Update to 0.29.13 minimum",[78,79,80,75,81],"Full chain","10.0 effective","\u003C 0.29.13 with default secret","Update + secret rotation",{"type":39,"title":83,"body":84},"Diagnosing your instance before applying the patch","Before proceeding with the update, accurately assess your instance's exposure.\n\n**Check the installed version**: `docker exec dokploy cat \u002Fapp\u002Fpackage.json | grep '\"version\"'`\n\nIf the version displayed is below 0.29.13, your instance is vulnerable to CVE-2026-72863. If it falls between 0.27.0 and 0.29.2, it is vulnerable to both CVEs simultaneously.\n\n**Check the JWT secret value**: `grep BETTER_AUTH_SECRET \u002Fetc\u002Fdokploy\u002F.env`\n\nIf the value is `better-auth-secret-123456789` or the variable is absent, CVE-2026-45631 is actively exploitable on your instance regardless of the version.\n\n**Check network exposure**: if your Dokploy interface is accessible from the Internet without IP restriction (firewall, Cloudflare Access, VPN), the attack surface is public. An attacker needs no prior network access to exploit CVE-2026-45631.",{"type":86,"title":87,"steps":88},"steps","Step-by-step update guide to Dokploy 0.29.13",[89,92,95,98,101,104],{"title":90,"body":91},"Back up configuration and data","Before any operation, create a full backup.\n\n```bash\n# Back up the configuration directory\ncp -r \u002Fetc\u002Fdokploy \u002Fetc\u002Fdokploy.bak-$(date +%Y%m%d-%H%M)\n\n# Back up the Dokploy database\ndocker exec dokploy-postgres pg_dump -U dokploy dokploy > \u002Froot\u002Fdokploy-db-$(date +%Y%m%d).sql\n```\n\nKeep these backups off the Dokploy host — if the instance is compromised, local backups are accessible to the attacker.",{"title":93,"body":94},"Check the current version and docker-compose.yml","Identify the installation method and pinned version in your Compose file. Most Dokploy installations use the official `dokploy\u002Fdokploy` image. If a version tag is pinned in `docker-compose.yml`, note it.\n\n```bash\ncat \u002Fetc\u002Fdokploy\u002Fdocker-compose.yml | grep 'image:'\n```",{"title":96,"body":97},"Update the Dokploy image","From the Dokploy configuration directory:\n\n```bash\ncd \u002Fetc\u002Fdokploy\ndocker compose pull\n```\n\nThis command downloads the `dokploy\u002Fdokploy:latest` image or the pinned tag. To explicitly pin the fixed version, update the `image` line in `docker-compose.yml`: replace the existing tag with `dokploy\u002Fdokploy:0.29.13` before running the pull.",{"title":99,"body":100},"Restart the containers","```bash\ncd \u002Fetc\u002Fdokploy\ndocker compose down\ndocker compose up -d\n```\n\nWait for the containers to reach a `healthy` state before continuing:\n\n```bash\ndocker compose ps\n```\n\nBoth Dokploy and its PostgreSQL database must show `Up` or `healthy`.",{"title":102,"body":103},"Regenerate the BETTER_AUTH_SECRET variable","This is the most important and most frequently skipped step. An update without secret rotation leaves CVE-2026-45631 exploitable. Generate a new cryptographically secure random value:\n\n```bash\nopenssl rand -base64 48\n```\n\nCopy the generated value. Open `\u002Fetc\u002Fdokploy\u002F.env` and replace the `BETTER_AUTH_SECRET=...` line with the new value. If the variable is absent from the file, add it.\n\nThen restart Dokploy to apply the change:\n\n```bash\ncd \u002Fetc\u002Fdokploy && docker compose down && docker compose up -d\n```\n\nNote: rotating the secret invalidates all active sessions. Connected users will need to log in again.",{"title":105,"body":106},"Verify the version after update","Confirm that version 0.29.13 or higher is running:\n\n```bash\ndocker exec dokploy cat \u002Fapp\u002Fpackage.json | grep '\"version\"'\n```\n\nAlso verify the secret has been applied:\n\n```bash\ngrep BETTER_AUTH_SECRET \u002Fetc\u002Fdokploy\u002F.env\n```\n\nThe value must no longer be `better-auth-secret-123456789`. If it still is, the rotation was not applied — repeat the previous step.",{"type":39,"title":108,"body":109},"Post-patch hardening measures","The update fixes both CVEs. These additional measures reduce the residual attack surface.\n\n**Restrict network access to the Dokploy interface.** The Dokploy administration interface has no reason to be publicly accessible from the Internet. Limit access to port 3000 (or whichever port you use) to your team's IPs via the host firewall, or place Dokploy behind a VPN.\n\n**Enable multi-factor authentication (MFA).** Dokploy has supported TOTP since version 0.28.0. Enable it for all administration accounts.\n\n**Audit project environment secrets.** Dokploy stores the environment variables of your applications. If the instance was exposed during the vulnerability window (versions 0.27.0 to 0.29.12), consider all production secrets potentially read. Rotation recommended for API keys, database tokens, and application secrets.\n\n**Docker socket and least-privilege principle.** The Docker socket mounted as a volume is a documented and exploited attack surface in CVE-2026-72863. Dokploy requires it to function, but access can be restricted via Docker socket proxy policies like `Tecnativa\u002Fdocker-socket-proxy` to limit authorized operations.",{"type":39,"title":111,"body":112},"Is Dokploy still reliable despite these CVEs?","These two vulnerabilities are serious, but the Dokploy maintainers' response deserves consideration before drawing conclusions about the project's maturity.\n\nThe advisories were published on September 25, 2026. The fix for CVE-2026-45631 was available in version 0.29.3, and the fix for CVE-2026-72863 in version 0.29.13 — both within a reasonable timeframe after responsible disclosure. The project maintains a security program via GitHub Security Advisories, indicating minimal maturity in vulnerability management.\n\nDokploy is a young project (first stable version in 2024) with rapid adoption: over 15,000 GitHub stars and a sustained release cadence. The presence of a hardcoded secret in early versions reflects security debt typical of fast-growing projects where ease of installation took priority over hardening defaults.\n\nThe project remains a relevant choice for teams wanting an accessible self-hosted PaaS, provided they follow security updates and apply the hardening measures described in this article.",{"type":39,"title":114,"body":115},"Alternatives if you are considering migrating","If these vulnerabilities lead you to reconsider your self-hosted PaaS choice, here are the active alternatives in this segment.\n\n**Coolify** is the closest alternative in terms of features. Open source, actively maintained, with a more mature security model for secret management (no documented hardcoded default value to date). Its interface is more complex but its codebase is larger and more audited.\n\n**Caprover** is a proven option, older and therefore with a longer security track record. It is less active in terms of new features but more stable.\n\n**Portainer with Docker stacks** remains a valid approach for teams that do not need a full PaaS. Portainer carries its own historical CVEs — notably around privilege escalation via the Docker API — but version 3.x has revised its authorization management.\n\nWhatever alternative is chosen, applying the same hardening measures (restricted network access, MFA, regular secret rotation) remains the non-negotiable baseline.",{"type":46,"title":117,"body":118},"On a ServOrbit VPS, the patch comes down to two commands","Running `docker compose pull && docker compose up -d` from `\u002Fetc\u002Fdokploy`, followed by regenerating `BETTER_AUTH_SECRET`, applies the complete fix. On a VPS with root access, you choose your own maintenance window without depending on a hosting provider. If you deployed Dokploy via the ServOrbit template, the `.env` file is in `\u002Fetc\u002Fdokploy\u002F` and the `docker-compose.yml` is the one provided by the template.",{"type":39,"title":120,"body":121},"Summary: the non-negotiables","CVE-2026-45631 (CVSS 10.0) and CVE-2026-72863 (CVSS 9.9) chain into an accountless-to-root-on-host attack. Any Dokploy instance below 0.29.13 with the default secret `better-auth-secret-123456789` is compromisable from any network.\n\nThe fix requires two distinct and both mandatory steps: updating to version 0.29.13 minimum (`docker compose pull && docker compose up -d`), and regenerating `BETTER_AUTH_SECRET` in the `.env` file (`openssl rand -base64 48`). Either one without the other closes only half the surface.\n\nAfter the update, restrict network access to the administration interface, enable MFA, and if the instance was exposed during the vulnerability window, rotate all hosted application secrets.","Deploy Dokploy on a VPS you control","On a ServOrbit VPS with root access, you apply this patch in two commands at a time of your choosing — without waiting for a maintenance window imposed by a hosting provider. The Dokploy template is available on the Marketplace.","Deploy Dokploy","\u002Fmarketplace\u002Fapplication-deployment-devops\u002Fdokploy",[127,148,170,188,207],{"id":128,"slug":129,"slugs":130,"title":134,"excerpt":135,"readTime":136,"views":18,"isPinned":19,"publishedAt":137,"updatedAt":138,"category":139,"categories":144,"featuredImage":30,"bgImage":31,"posterImage":146,"relatedSolution":147},42,"deploy-your-applications-with-dokploy-on-a-vps",{"fr":131,"en":129,"ar":132,"es":133},"deployer-avec-dokploy","نشر-تطبيقاتك-باستخدام-dokploy-على-vps","desplegar-aplicaciones-con-dokploy-en-un-vps","Deploy Your Applications with Dokploy on a VPS","Deploy your applications with Dokploy on a VPS: an open source PaaS with built-in Traefik, Docker Compose, databases, and Git deployments.",9,"2026-05-09T00:00:00+00:00","2026-09-21T15:22:03+00:00",{"id":140,"name":141,"slug":142,"color":143,"icon":142},3,"Deployment","deploiement","bg-success\u002F10 text-success",[145],{"id":140,"name":141,"slug":142,"color":143,"icon":142},"\u002Fblog\u002Fcovers\u002Fdeployer-avec-dokploy-poster.svg",{"categorySlug":34,"appSlug":35},{"id":149,"slug":150,"slugs":151,"title":155,"excerpt":156,"readTime":157,"views":158,"isPinned":19,"publishedAt":159,"updatedAt":160,"category":161,"categories":166,"featuredImage":30,"bgImage":31,"posterImage":168,"relatedSolution":169},104,"portainer-vs-dokploy-which-docker-management-interface",{"fr":152,"en":150,"ar":153,"es":154},"portainer-vs-dokploy","portainer-مقابل-dokploy-أي-واجهة-لإدارة-docker","portainer-vs-dokploy-interfaz-de-gestion-docker","Portainer vs Dokploy: which to deploy in 2026?","Full comparison of Portainer 2.x vs Dokploy on VPS: critical CVEs, CE 3.0 situation, step-by-step migration and decision criteria.",10,1,"2026-03-08T00:00:00+00:00","2026-09-25T23:43:04+00:00",{"id":162,"name":163,"slug":164,"color":165,"icon":164},5,"Comparison","comparatif","bg-info\u002F10 text-info",[167],{"id":162,"name":163,"slug":164,"color":165,"icon":164},"\u002Fblog\u002Fcovers\u002Fportainer-vs-dokploy-poster.svg",{"categorySlug":34,"appSlug":35},{"id":171,"slug":172,"slugs":173,"title":177,"excerpt":178,"readTime":157,"views":18,"isPinned":19,"publishedAt":179,"updatedAt":180,"category":181,"categories":182,"featuredImage":30,"bgImage":31,"posterImage":184,"relatedSolution":185},360,"n8n-cve-2026-21877-critical-rce-patch",{"fr":174,"en":172,"ar":175,"es":176},"n8n-cve-2026-21877-mise-a-jour-urgence","n8n-cve-2026-21877-تصحيح-ثغرة-rce","n8n-cve-2026-21877-parche-rce-critico","n8n CVE-2026-21877: patch critical RCE CVSS 9.9 now","CVE-2026-21877 enables authenticated remote code execution in n8n (CVSS 9.9). Update to ≥ 1.121.3 and apply the scheduling workaround.","2026-09-18T00:00:00+00:00","2026-09-19T02:00:43+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[183],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fn8n-cve-2026-21877-mise-a-jour-urgence-poster.svg",{"categorySlug":186,"appSlug":187},"automation-workflows","n8n",{"id":189,"slug":190,"slugs":191,"title":195,"excerpt":196,"readTime":197,"views":158,"isPinned":19,"publishedAt":198,"updatedAt":199,"category":200,"categories":201,"featuredImage":30,"bgImage":31,"posterImage":203,"relatedSolution":204},108,"securing-your-vps-with-crowdsec",{"fr":192,"en":190,"ar":193,"es":194},"securiser-vps-crowdsec","تأمين-خادمك-الافتراضي-vps-باستخدام-crowdsec","proteger-vps-con-crowdsec","Securing your VPS with CrowdSec","Deploy CrowdSec on your VPS to block attacks thanks to behavioral detection and a shared community blocklist.",4,"2026-03-04T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[202],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fsecuriser-vps-crowdsec-poster.svg",{"categorySlug":205,"appSlug":206},"cybersecurity-bastion","crowdsec",{"id":208,"slug":209,"slugs":210,"title":214,"excerpt":215,"readTime":197,"views":18,"isPinned":19,"publishedAt":216,"updatedAt":199,"category":217,"categories":218,"featuredImage":30,"bgImage":31,"posterImage":220,"relatedSolution":30},115,"configure-your-vps-firewall-with-ufw",{"fr":211,"en":209,"ar":212,"es":213},"pare-feu-ufw-vps","تهيئة-جدار-الحماية-ufw-على-خادمك-vps","configurar-firewall-ufw-vps","Configure Your VPS Firewall with UFW","Configure your VPS firewall with UFW step by step: rules, ports, SSH rate limiting and best practices to reduce the attack surface.","2026-02-25T00:00:00+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[219],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fpare-feu-ufw-vps-poster.svg",1790385779134]