CVE-2026-111331: Authorization Bypass Through User-Controlled Key

Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any organization to manage other tenants' ports because the target application's organization is never verified. Attackers supplying a known portId or...

Dokploy authorization issue vulnerability

Dokploy versions 0.30.8 and earlier have an authorization issue vulnerability. This vulnerability stems from the port tRPC router not verifying the organization to which the target application belongs. As a result, cross-organizational authorization bypasses occur. Attackers can read, modify,...

CVE-2026-93425

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe...

EUVD-2026-86253

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe...

CVE-2026-93425 Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe...

CVE-2026-93425 Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe...

CVE-2026-93425

Dokploy, a self-hostable Platform as a Service (PaaS), is vulnerable to Authenticated OS Command Injection in the patch.readRepoDirectories tRPC procedure prior to version 0.29.13 . The root cause is the lack of safe argument quoting when the user-controlled repoPath value from apps/dokploy/serve...

CVE-2026-93425 Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe...

PT-2026-97912

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description An authenticated organization member with service:read permission can execute arbitrary commands as root within the Dokploy container. The issue occurs because the patch.readRepoDirectories tRPC...

CVE-2026-93425: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe...

CVE-2026-86059

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintext provider credentials through github.one, gitlab.one, gitea.one, and bitbucket.one because those protected procedures return full provider...

EUVD-2026-84544

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintext provider credentials through github.one, gitlab.one, gitea.one, and bitbucket.one because those protected procedures return full provider...

CVE-2026-86059 Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintext provider credentials through github.one, gitlab.one, gitea.one, and bitbucket.one because those protected procedures return full provider...

CVE-2026-86059

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintext provider credentials through github.one, gitlab.one, gitea.one, and bitbucket.one because those protected procedures return full provider...

CVE-2026-86059 Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintext provider credentials through github.one, gitlab.one, gitea.one, and bitbucket.one because those protected procedures return full provider...

CVE-2026-86059 Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintext provider credentials through github.one, gitlab.one, gitea.one, and bitbucket.one because those protected procedures return full provider...

CVE-2026-86059

Prior to version 0.29.13 , the self-hostable PaaS Dokploy suffered from a vulnerability where organization members without Git provider access could retrieve plaintext credentials. The root cause is that certain protected procedures for github.one , gitlab.one , gitea.one , and bitbucket.one fail...

CVE-2026-86059: Exposure of Sensitive Information to an Unauthorized Actor

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintext provider credentials through github.one, gitlab.one, gitea.one, and bitbucket.one because those protected procedures return full provider...

PT-2026-96827

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description Organization members without Git provider access can retrieve plaintext provider credentials. This occurs because the protected procedures 'github.one', 'gitlab.one', 'gitea.one', and 'bitbucket.on...

Dokploy is vulnerable to OS command injection

Overview Dokploy versions 0.29.8 and 0.29.11, as well as commit 24b02f5 on the canary branch, are vulnerable to OS command injection during the backup creation and restoration processes. The vulnerability stems from unsanitized shell command construction that can allow an attacker to escalate...