CVE-2026-72873 Dokploy: Cross-tenant Git provider secrets are disclosed to low-privileged service readers via `application.one`

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by findApplicationById in packages/server/src/services/application.ts without redacting githubClientSecret,...

CVE-2026-72873

Dokploy prior to v0.29.13 exposes Git provider secrets (githubClientSecret, githubPrivateKey, githubWebhookSecret) to users with only service:read by returning provider relations in application.one without redaction. Affected code paths: application.one in apps/dokploy/server/api/routers/applicat...

CVE-2026-72873 Dokploy: Cross-tenant Git provider secrets are disclosed to low-privileged service readers via `application.one`

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by findApplicationById in packages/server/src/services/application.ts without redacting githubClientSecret,...

EUVD-2026-55737

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by findApplicationById in packages/server/src/services/application.ts without redacting githubClientSecret,...

CVE-2026-72873

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by findApplicationById in packages/server/src/services/application.ts without redacting githubClientSecret,...

CVE-2026-72873 Dokploy: Cross-tenant Git provider secrets are disclosed to low-privileged service readers via `application.one`

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by findApplicationById in packages/server/src/services/application.ts without redacting githubClientSecret,...

EUVD-2026-55733

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validation and cloneBitbucketRepository in packages/server/src/utils/providers/bitbucket.ts interpolates those values into git clo...

CVE-2026-72872

CVE-2026-72872 affects Dokploy PaaS prior to version 0.29.13. Affected component: packages/server/src/utils/providers/bitbucket.ts, where bitbucketOwner and bitbucketRepository are stored/used without validation and interpolated into git clone commands executed via execAsync/execAsyncRemote. This...

CVE-2026-72872 Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone`

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validation and cloneBitbucketRepository in packages/server/src/utils/providers/bitbucket.ts interpolates those values into git clo...

CVE-2026-72872

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validation and cloneBitbucketRepository in packages/server/src/utils/providers/bitbucket.ts interpolates those values into git clo...

CVE-2026-72872 Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone`

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validation and cloneBitbucketRepository in packages/server/src/utils/providers/bitbucket.ts interpolates those values into git clo...

CVE-2026-72872 Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone`

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validation and cloneBitbucketRepository in packages/server/src/utils/providers/bitbucket.ts interpolates those values into git clo...

CVE-2026-72871

Dokploy (PaaS) vulnerability CVE-2026-72871: Before version 0.29.13, the unauthenticated /api/providers/github/setup route in Dokploy trusts gh_init organizationId and userId from the state and calls createGithub, enabling an attacker to insert a GitHub App provider containing client_secret, webh...

CVE-2026-72871 Dokploy: Unauthenticated Git Provider Injection via GitHub OAuth Callback

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts ghinit organizationId and userId values from the state parameter and calls createGithub in...

CVE-2026-72867

Dokploy is a free, self-hostable Platform as a Service PaaS. From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch...

CVE-2026-72867 Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts)

Dokploy is a free, self-hostable Platform as a Service PaaS. From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch...

EUVD-2026-55725

Dokploy is a free, self-hostable Platform as a Service PaaS. From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch...

CVE-2026-72740

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain into the ssh-keyscan command from addHostToKnownHostsCommand without shell quoting...

CVE-2026-72718

goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the goose review command runs the system git executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose .git/config sets core fsmonitor = causes Git to...

CVE-2026-72718

Goose before v1.44.0 is vulnerable: the goose review path runs Git diff with a user-controlled core.fsmonitor config via the repository’s .git/config. This lets an attacker with a malicious repo execute arbitrary commands when git diff runs for touched_files()/collect_diff(), since the context-ga...