A critical command injection vulnerability in Dokploy permits authenticated users to execute arbitrary commands on remote managed servers via malformed Traefik configurations.

The writeTraefikConfigRemote function fails to properly neutralize shell metacharacters when processing user-controlled Traefik configurations. This flaw, which serves as an incomplete fix for CVE-2026-45630, allows an authenticated attacker to inject arbitrary commands that execute with the privileges of the configured SSH user on remote servers.

With a CVSS score of 9.9, this vulnerability represents an extreme risk to the integrity and security of remote managed infrastructure. An attacker can pivot from the Dokploy control plane to gain full control over connected remote servers, leading to widespread system compromise and potential data exfiltration across the entire managed environment.

Immediate Action: Upgrade all instances of Dokploy to version 0.29.13 or later to remediate the insecure configuration handling.

Proactive Monitoring: Audit remote server access logs and monitor for unusual SSH command patterns originating from the Dokploy control plane.

Compensating Controls: Implement strict SSH key-based authentication with limited privileges for the service users utilized by Dokploy to minimize the impact of command execution.

Public Exploit Available: Unknown

This vulnerability requires immediate attention due to its potential for remote infrastructure takeover. Organizations must update their Dokploy deployments to version 0.29.13 or later to ensure that configuration inputs are correctly neutralized and the attack vector is closed.