CVE-2026-24839

6.1 mediumEPSS 0.2%

Medium (6.1) in dokploy dokploy. EPSS 0.2% chance of exploitation in the next 30 days.

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, the Dokploy web interface is vulnerable to Clickjacking attacks due to missing frame-busting headers. This allows attackers to embed Dokploy pages in malicious iframes and trick authenticated users into performing unintended actions. Version 0.26.6 patches the issue.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-31)
CWE: CWE-1021
Published: 2026-01-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dokploy:dokploy

References

https://github.com/Dokploy/dokploy/commit/9714695d5a78fe24496f989ab81807ba04699df8
https://github.com/Dokploy/dokploy/pull/3500
https://github.com/Dokploy/dokploy/security/advisories/GHSA-c94j-8wgf-2q9q

Check your stack JSON