CVE-2026-24840
📋 TL;DR
Dokploy versions before 0.26.6 contain hardcoded database credentials in the installation script, allowing attackers with network access to the database to compromise all Dokploy instances using default installation. All self-hosted Dokploy deployments using the standard installation method are affected.
💻 Affected Systems
- Dokploy
📦 What is this software?
Dokploy by Dokploy
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Dokploy database leading to data theft, service disruption, and potential lateral movement to other systems.
Likely Case
Unauthorized database access allowing data exfiltration, modification, or deletion of Dokploy configuration and application data.
If Mitigated
Limited impact if database is isolated with network controls, but credentials remain exposed.
🎯 Exploit Status
Exploitation requires network access to the database container/port and knowledge of the hardcoded credentials
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.26.6
Vendor Advisory: https://github.com/Dokploy/dokploy/security/advisories/GHSA-jr65-3j3w-gjmc
Restart Required: Yes
Instructions:
1. Update Dokploy to version 0.26.6 or later. 2. Regenerate database credentials. 3. Restart Dokploy services.
🔧 Temporary Workarounds
Manual credential rotation
linuxManually change database credentials and update Dokploy configuration
docker exec -it dokploy_db psql -U postgres -c "ALTER USER dokploy WITH PASSWORD 'new_secure_password';"
Update DB_PASSWORD in Dokploy .env file
docker-compose restart
🧯 If You Can't Patch
- Isolate database container from network access using firewall rules
- Implement network segmentation to restrict database access to only Dokploy application
🔍 How to Verify
Check if Vulnerable:
Check install.sh script line 154 for hardcoded password or verify Dokploy version is below 0.26.6Check Version:
docker exec dokploy_app cat /app/package.json | grep versionVerify Fix Applied:
Confirm Dokploy version is 0.26.6+ and database credentials are not the default hardcoded value📡 Detection & Monitoring
Log Indicators:
- Failed database authentication attempts
- Unexpected database connections from unauthorized sources
Network Indicators:
- Connection attempts to database port (default 5432) from unexpected IPs
SIEM Query:
source="database_logs" AND (event_type="authentication_failure" OR event_type="connection_from_unexpected_ip")