PT-2026-5044 · Dokploy · Dokploy

Agenthits · Published 2026-01-28 · Updated 2026-01-28 · CVE-2026-24839

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.26.6

Description Dokploy is a self-hostable Platform as a Service (PaaS). The web interface is susceptible to Clickjacking attacks because of missing frame-busting headers. This allows attackers to embed Dokploy pages within malicious iframes, potentially deceiving authenticated users into performing actions they did not intend.

Recommendations Update to version 0.26.6 or later.

Exploit

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2026-24839

GHSA-C94J-8WGF-2Q9Q

Affected Products

Dokploy

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24839.json · Exploit
• https://github.com/Dokploy/dokploy/commit/9714695d5a78fe24496f989ab81807ba04699df8 · Patch
• https://github.com/Dokploy/dokploy/security/advisories/GHSA-c94j-8wgf-2q9q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24839 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24839 · Security Note
• https://github.com/Dokploy/dokploy/pull/3500 · Note
• https://twitter.com/CVEnew/status/2016319518633546214 · Twitter Post
• https://t.me/cveNotify/150066 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2016458484326318208 · Twitter Post
• https://t.me/CVEtracker/43093 · Telegram Post