CVE-2026-45630: Dokploy: Authenticated Remote Code Execution via Command Injection in updateTraefikConfig Echo Statement

Synopsis

An authenticated OS command injection in Dokploy's `application.updateTraefikConfig` tRPC endpoint lets admin or owner users inject arbitrary shell commands through an unsanitized `echo` interpolation. The endpoint is reached over the network and requires a high-privilege account, but no victim interaction. Successful exploitation runs attacker-chosen commands on the remote server hosting Dokploy, yielding full code execution, file tampering, and service disruption. No fix version has been published yet; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Dokploy tRPC endpoint over the network.

• AuthenticationRequired

  An admin or owner account on the Dokploy instance is required to call the vulnerable endpoint.

• Victim interactionNot required

  Exploitation is driven entirely by the attacker's API call; no user has to click or approve anything.

• Attack complexityDetail

  Attack complexity is low: the injection is a reliable shell interpolation with no race or environmental preconditions.

Blast Radius

• Executes arbitrary OS commands on the server hosting Dokploy under the service account running the platform.
• Reads any files and secrets accessible to the Dokploy process, including deployment credentials and Traefik configuration.
• Modifies system state and persisted configuration, allowing backdoors or tampering with managed applications.
• Can disrupt Dokploy-managed services and the Traefik proxy, causing partial availability loss.