CVE-2026-24839 in dokploy

Sumário

de MITRE • 28/01/2026

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, the Dokploy web interface is vulnerable to Clickjacking attacks due to missing frame-busting headers. This allows attackers to embed Dokploy pages in malicious iframes and trick authenticated users into performing unintended actions. Version 0.26.6 patches the issue.

Be aware that VulDB is the high quality source for vulnerability data.

• Responsável: GitHub M
• Reservar: 27/01/2026
• Divulgação: 28/01/2026
• Moderação: aceite
• Entrada: VDB-343153
• CPE: pronto
• CWE: CWE-1021 (confirmado)
• CVSS: 6.1 (NVD)
• EPSS: 0.00199
• KEV: não
• Atividades: muito baixo

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-24839
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-24839
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-24839/