CVE-2026-72902

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts...

CVE-2026-72901

CVE-2026-72901 affects Dokploy before version 0.29.13. An authenticated low-privilege user could run arbitrary commands on the control-plane host due to the volumeName field used by volumeBackup.create/runManually being interpolated without quoting in packages/server/src/utils/volume-backups/back...

CVE-2026-72873

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by findApplicationById in packages/server/src/services/application.ts without redacting githubClientSecret,...

CVE-2026-72873 Dokploy: Cross-tenant Git provider secrets are disclosed to low-privileged service readers via `application.one`

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by findApplicationById in packages/server/src/services/application.ts without redacting githubClientSecret,...

CVE-2026-72870

Dokploy's buildRemoteDocker vulnerability affects Dokploy before 0.29.13. The buildRemoteDocker() function interpolates the application-controlled dockerImage value directly into a docker pull command, enabling an authenticated user with project access to craft a dockerImage via application.updat...