Security readout for executives and security teams
Plain-English summary
A Dokploy member allowed to deploy services could abuse unvalidated Bitbucket project details to run operating-system commands. Successful abuse could compromise the Dokploy host or a deployment target, exposing applications, credentials, and data while enabling service disruption. Dokploy versions before 0.29.13 are affected; version 0.29.13 fixes the issue.
Executive priority
Treat this as an immediate remediation item for affected Dokploy environments. The prerequisite account permission limits exposure, but successful abuse could provide complete command execution across hosting infrastructure. Prioritize internet-accessible management deployments, broadly delegated teams, and installations managing sensitive applications or production credentials.
Technical view
CVE-2026-72872 is a CWE-78 command-injection flaw. Dokploy stored Bitbucket owner and repository values without validation, then interpolated them into git clone commands executed locally or remotely. Exploitation requires an authenticated member with service deployment permission. The CVSS 3.1 score is 9.9 because resulting commands can cross a security boundary and fully affect confidentiality, integrity, and availability.
Likely exposure
Self-hosted Dokploy installations before 0.29.13 are exposed when members with service deployment permission can configure Bitbucket-backed deployments. Impact may reach the Dokploy host or a configured target server. The supplied sources report that version 0.29.13 fixes the vulnerability.
Exploitation context
The flaw is remotely reachable through Dokploy but requires authenticated, low-privilege access with service deployment permission. No user interaction or complex conditions are reported. The source bundle marks it absent from KEV and provides no evidence of exploitation in the wild; this does not prove exploitation has never occurred.
Researcher notes
The vulnerable flow spans application.saveBitbucketProvider and cloneBitbucketRepository: unvalidated stored fields reach command construction used by execAsync or execAsyncRemote. Assessment should cover both the Dokploy controller and remote deployment targets. The supplied material identifies the fixing release and code change but does not establish public exploitation or compromise indicators.
Mitigation direction
- Upgrade every Dokploy installation to version 0.29.13 or later.
- Until upgraded, remove or tightly restrict service deployment permission from nonessential members.
- Restrict management access to trusted administrators and networks where operationally feasible.
- Review the vendor advisory and release notes before completing remediation.
Validation and detection
- Inventory all Dokploy instances and confirm their installed versions.
- Identify every member holding service deployment permission and verify business need.
- Review Bitbucket provider configurations and deployment activity for unexpected owner or repository values.
- Inspect Dokploy hosts and target servers for unexplained commands, processes, files, or credential access.
- After upgrading, confirm normal Bitbucket deployments operate successfully.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-72872 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H3.16GitHub_MVulnerability scoring details
Base CVSS 3.1 score
9.9CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/Dokploy/dokploy/security/advisories/GHSA-grrj-6xrh-j6vpCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/Dokploy/dokploy/pull/4855CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/Dokploy/dokploy/commit/47347ab885b0ad1f5d0ef0e5e74bbba35c7f93bcCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/Dokploy/dokploy/releases/tag/v0.29.13CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.