What’s Vulnerable › Vulnerabilities

CVE-2026-24839: Dokploy has a clickjacking vulnerability - Missing X-Frame-Options and CSP frame-ancestors headers

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-28 · updated 2026-06-17
• Weakness: CWE-1021

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, the Dokploy web interface is vulnerable to Clickjacking attacks due to missing frame-busting headers. This allows attackers to embed Dokploy pages in malicious iframes and trick authenticated users into performing unintended actions. Version 0.26.6 patches the issue.

Affected products

• dokploy: before 0.26.6 — fixed in 0.26.6

How to fix

Upgrade to a fixed version: dokploy 0.26.6. Check the vendor advisory for mitigations.

References

• https://github.com/Dokploy/dokploy/commit/9714695d5a78fe24496f989ab81807ba04699df8
• https://github.com/Dokploy/dokploy/pull/3500
• https://github.com/Dokploy/dokploy/security/advisories/GHSA-c94j-8wgf-2q9q

Get alerted when CVE-2026-24839 or the next vulnerability affects your stack