CVE-2026-24840

PoC —

CVSS 3.1

8.8 high

EPSS

<1%p28

Published

Jan 28, 2026 (Jan 28, 2026)

Modified

Jun 17, 2026

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a hardcoded credential in the provided installation script (located at https://dokploy.com/install.sh, line 154) uses a hardcoded password when creating the database container. This means that nearly all Dokploy installations use the same database credentials and could be compromised. Version 0.26.6 contains a patch for the issue.

Vendors: dokploy
Products: dokploy
Weakness: CWE-798
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.