CVE-2026-24839

Published: Jan 28, 2026Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, the Dokploy web interface is vulnerable to Clickjacking attacks due to missing frame-busting headers. This allows attackers to embed Dokploy pages in malicious iframes and trick authenticated users into performing unintended actions. Version 0.26.6 patches the issue.

Affected (1)

Products: Dokploy: Dokploy

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Dokploy Dokploy	Before 0.26.6

Related CWEs

Improper Restriction of Rendered UI Layers or Frames

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.

References (3)

https://github.com/Dokploy/dokploy/commit/9714695d5a78fe24496f989ab81807ba04699df8

Source: security-advisories@github.com

Patch

https://github.com/Dokploy/dokploy/pull/3500

Source: security-advisories@github.com

Issue Tracking

https://github.com/Dokploy/dokploy/security/advisories/GHSA-c94j-8wgf-2q9q

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.