CVE-2026-24840— Dokploy uses hardcoded credentials in installation script, which could result in database access
Quick assessment
Affected
Dokploy dokploy
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Dokploy是Dokploy开源的一个开源软件。 Dokploy 0.26.6之前版本存在信任管理问题漏洞，该漏洞源于安装脚本中存在硬编码凭证，可能导致数据库凭据泄露。
Possible ATT&CK Techniques 1 AI
T1552 · Unsecured Credentials
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-24840
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Dokploy uses hardcoded credentials in installation script, which could result in database access
Source: CVE Program / CVE List V5
Vulnerability Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a hardcoded credential in the provided installation script (located at https://dokploy.com/install.sh, line 154) uses a hardcoded password when creating the database container. This means that nearly all Dokploy installations use the same database credentials and could be compromised. Version 0.26.6 contains a patch for the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用硬编码的凭证
Source: CVE Program / CVE List V5
Vulnerability Title
Dokploy 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Dokploy是Dokploy开源的一个开源软件。 Dokploy 0.26.6之前版本存在信任管理问题漏洞，该漏洞源于安装脚本中存在硬编码凭证，可能导致数据库凭据泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-24840
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-24840
请登录查看更多情报信息。
Same Patch Batch · Dokploy · 2026-01-28 · 3 CVEs total
| CVE-2026-24841 | 9.9 CRITICAL | Dokploy Vulnerable to Authenticated Remote Code Execution via Command Injection in Docker |
| CVE-2026-24839 | 4.7 MEDIUM | Dokploy has a clickjacking vulnerability - Missing X-Frame-Options and CSP frame-ancestors |
IV. Related Vulnerabilities
Same product: dokploy
-
CVE-2026-93425
Dokploy: Authenticated OS Command Injection in patch.readRep -
CVE-2026-86059
Dokploy: Git Provider Credential Exposure via Unprotected .o -
CVE-2026-82954
Dokploy Settings application.ts writeTraefikConfigInPath pat -
CVE-2026-45791
Dokploy: Password Change Does Not Revoke Active Sessions -
CVE-2026-45790
Dokploy: Invitation Role Escalation Allows Organization Take
Same vendor: Dokploy
-
CVE-2026-93425
Dokploy: Authenticated OS Command Injection in patch.readRep -
CVE-2026-86059
Dokploy: Git Provider Credential Exposure via Unprotected .o -
CVE-2026-45791
Dokploy: Password Change Does Not Revoke Active Sessions -
CVE-2026-45790
Dokploy: Invitation Role Escalation Allows Organization Take -
CVE-2026-72902
Dokploy: Authenticated RCE via Command Injection in registry
Same weakness: CWE-798
-
CVE-2026-105147
SciPhi-AI R2R JWT Secret hard-coded credentials -
CVE-2026-105141
topoteretes cognee JWT Signing Key get_api_auth_backend.py g -
CVE-2026-94592
Armatura LLC Armatura One Use of Hard-coded Credentials -
CVE-2026-103097
GV-Eye Relay Payment API Key Vulnerability -
CVE-2026-103096
GV-Eye Hardcoded API Key Vulnerability
V. Comments for CVE-2026-24840
No comments yet