CVE-2026-72873: Exposure of Sensitive Information to an Unauthorized Actor

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by findApplicationById in packages/server/src/services/application.ts without redacting githubClientSecret,...

PT-2026-69913

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description Dokploy is a self-hostable Platform as a Service PaaS. A flaw exists where the application.saveBitbucketProvider function stores bitbucketOwner and bitbucketRepository without proper validation...

CVE-2026-72866: Missing Authorization

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the WebSocket handler in apps/dokploy/server/wss/terminal.ts validates a session but does not authorize access to the requested server. An authenticated user can connect to /terminal?serverId=local, select the special...

CVE-2026-72734: Authorization Bypass Through User-Controlled Key

Dokploy is a free, self-hostable Platform as a Service PaaS. From 0.28.7 until 0.29.13, the server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId and calls haveActiveServices, findServerById, removeDeploymentsByServerId, and deleteServer...

PT-2026-69880

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description In the writeTraefikConfigRemote function within packages/server/src/utils/traefik/application.ts, user-controlled Traefik configuration is serialized using yaml.stringify and then interpolated into...

CVE-2026-72882: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. In 0.28.8 and earlier, an authenticated user who can create or update file mounts for a service can inject shell metacharacters into filePath, causing Dokploy to execute attacker-controlled commands on the configured remote managed serv...

CVE-2026-72883: Missing Authorization

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the WebSocket handlers in apps/dokploy/server/wss/terminal.ts, apps/dokploy/server/wss/docker-container-terminal.ts, apps/dokploy/server/wss/docker-container-logs.ts, and apps/dokploy/server/wss/docker-stats.ts validat...

CVE-2026-72902: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts...

PT-2026-69936

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.28.9 Description Dokploy is a free, self-hostable Platform as a Service PaaS. An authenticated user with permissions to create or update file mounts for a service can inject shell metacharacters into the filePath...

PT-2026-69879

Name of the Vulnerable Software and Affected Versions Dokploy versions 0.28.7 through 0.29.12 Description The server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId and executes the functions haveActiveServices, findServerById,...

PT-2026-69943

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description Dokploy is a self-hostable Platform as a Service PaaS that allows an authenticated low-privilege member to execute arbitrary commands on the control-plane host. The issue occurs because the...

PT-2026-69882

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.9 Description An issue exists where the application fails to verify if the destination.organizationId matches the ctx.session.activeOrganizationId when processing requests. This allows an authenticated member wit...

PT-2026-69944

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description Dokploy, a self-hostable Platform as a Service PaaS, contains a flaw that allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server. This occurs because t...

PT-2026-69918

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description An issue exists where the endpoint application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by the findApplicationById function in...

PT-2026-69905

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description An issue exists in the local branch of the '/docker-container-terminal' endpoint within the docker-container-terminal.ts file. While the system uses validateRequest for authentication, it fails to...

PT-2026-69881

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description Dokploy passes user-controlled values directly into shell commands through unquoted template literal interpolation. This occurs within the registry credential testing and Docker Swarm cluster...

PT-2026-69910

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description An authenticated user with backup:restore permissions can execute arbitrary commands on the Docker-privileged host. The issue occurs because the backup.restoreBackupWithLogs tRPC subscription passe...

PT-2026-69940

Name of the Vulnerable Software and Affected Versions Dokploy versions 0.29.2 through 0.29.12 Description In the apps/dokploy/server/api/routers/schedule.ts file, the schedule.create and schedule.update endpoints derive the serviceId from the applicationId or composeId. Due to an error where the...

PT-2026-69924

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.8 Description The getRegistryCommands function in packages/server/src/utils/cluster/upload.ts fails to escape the registry.password and registry.registryUrl variables when interpolating them into a shell command...

CVE-2026-72880: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a client-supplied certificatePath, and packages/server/src/services/certificate.ts joins that value to the certificate root withou...