ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2025-30206

Dpanel is a Docker visualization panel system which provides complete Docker management functions.

Published Apr 15, 2025 · catalog updated Apr 15, 2025 · Dpanel is a Docker

Check if you run it

No confirmed exploitation is on record for CVE-2025-30206. EPSS is 0.90%. Act only if a listed version of Dpanel is a Docker is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Dpanel is a Docker).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Critical9.8
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.90%
Remediation
Version ranges on file
Affected products
vendor donknap dpanel < 1.6.1

Dpanel is a Docker visualization panel system which provides complete Docker management functions. The Dpanel service contains a hardcoded JWT secret in its default configuration, allowing attackers to generate valid JWT tokens and compromise the host machine. This security flaw allows attackers to analyze the source code, discover the embedded secret, and craft legitimate JWT tokens. By forging these tokens, an attacker can successfully bypass authentication mechanisms, impersonate privileged users, and gain unauthorized administrative access. Consequently, this enables full control over the

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • vendor donknap dpanel < 1.6.1< 1.6.1

How to fix CVE-2025-30206

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2025-30206. EPSS is 0.90%. Act only if a listed version of Dpanel is a Docker is installed.

Which versions are affected?

Compare what you have installed with donknap dpanel < 1.6.1 < 1.6.1. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 0.90%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Docker security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 15, 2025 · EUVD

    Detected

    Dpanel is a Docker visualization panel system which provides complete Docker management functions. The Dpanel service contains a hardcoded JWT secret in its default configuration, allowing attackers to generate valid JWT tokens and compromise the host machine. This security flaw allows attackers to analyze the source code, discover the embedded secret, and craft legitimate JWT tokens. By forging t

  2. Apr 15, 2025 · EUVD

    Updated

    Dpanel is a Docker visualization panel system which provides complete Docker management functions. The Dpanel service contains a hardcoded JWT secret in its default configuration, allowing attackers to generate valid JWT tokens and compromise the host machine. This security flaw allows attackers to analyze the source code, discover the embedded secret, and craft legitimate JWT tokens. By forging t

Sources

  • CVE.orgVulnerability recordCVE-2025-30206

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2025-30206

    30-day exploitation probability 0.9%

    first.org
  • EUVDVulnerability recordEUVD-2025-10989

    Dpanel is a Docker visualization panel system which provides complete Docker management functions. The Dpanel service contains a hardcoded JWT secret in its default configuration, allowing attackers to generate valid JWT tokens and compromise the host machine. This security flaw

    euvd.enisa.europa.eu

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.