CVE-2026-24839CWE-1021

Dokploy has a clickjacking vulnerability - Missing X-Frame-Options and CSP frame-ancestors headers

Medium · published January 28, 2026

CVSS v3.1
4.7
EPSS
0%
Percentile
13.9
In the wild
Unconfirmed
What it is

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, the Dokploy web interface is vulnerable to Clickjacking attacks due to missing frame-busting headers. This allows attackers to embed Dokploy pages in malicious iframes and trick authenticated users into performing unintended actions. Version 0.26.6 patches the issue.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00237 · 13.9th percentile
Weakness
CWE-1021 · Improper Restriction of Rendered UI Layers or Frames
Published
2026-01-28T00:01Z
EPSS history
Timeline
  • 28 JAN 00:01Z
    Dokploy has a clickjacking vulnerability - Missing X-Frame-Options and CSP frame-ancestors headers
    cvelistv5