Dokploy versions prior to 0.26.6 include a hardcoded password in the installation script, meaning that during deployment almost all instances use the same database credentials. This flaw allows an attacker who can influence the installation process or obtain the installation script to learn valid database credentials and potentially read, modify, or delete data stored in the database. The vulnerability is classified as CWE‑798, a use of hard‑coded credentials, and has a CVSS score of 8, signifying a high impact if exploited.

The affected vendor is Dokploy, and the product is Dokploy itself. Any instance running a build before version 0.26.6 deploys the vulnerable script. Version 0.26.6 and later contain a patch that removes the hard‑coded password.

The CVSS score of 8 indicates that an attacker who can exploit this flaw would face significant risk. However, the EPSS score of less than 1% suggests that exploitation attempts are rare, and at this time the vulnerability has not been listed in the CISA KEV catalog. The most likely attack vector is local or administrative, where an attacker can modify or replace the installation script, or compromise a system during the initial deployment. Once the credentials are known, an attacker can gain full access to the database, compromising confidentiality, integrity, and availability of any data managed by Dokploy.