Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2026-24839

Good to know:

icon
icon

Date: January 27, 2026

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, the Dokploy web interface is vulnerable to Clickjacking attacks due to missing frame-busting headers. This allows attackers to embed Dokploy pages in malicious iframes and trick authenticated users into performing unintended actions. Version 0.26.6 patches the issue.

Severity Score

Related Resources (5)

https://github.com/Dokploy/dokploy/security/advisories/GHSA-c94j-8wgf-2q9q
https://github.com/Dokploy/dokploy/commit/9714695d5a78fe24496f989ab81807ba04699df8
https://nvd.nist.gov/vuln/detail/CVE-2026-24839
https://github.com/Dokploy/dokploy/pull/3500
https://www.mend.io/vulnerability-database/CVE-2026-24839

Severity Score

Weakness Type (CWE)

Improper Restriction of Rendered UI Layers or Frames

CWE-1021

Top Fix

icon

Upgrade Version

Upgrade to version https://github.com/Dokploy/dokploy.git - v0.26.6

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality (C): NONE
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us