CVE-2026-72878

CVE-2026-72878 : Dokploy before 0.29.13 is vulnerable to OS command injection in the backup/restore pipeline. The system constructs shell commands by directly interpolating user-controlled database fields into bash -c and sh -c strings, then executes them via child_process.exec(), allowing an aut...

CVE-2021-34512

creationtimestamp| type| source ---|---|--- 2026-08-10 19:06:27+00:00| seen| https://bsky.app/profile/vulnsea.com/post/3msqsald3t72x...

EUVD-2026-55741

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in apps/dokploy/server/api/routers/swarm.ts accept another organization’s serverId without an activeOrganizationId ownership check, and...

CVE-2026-72876 Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.*

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in apps/dokploy/server/api/routers/swarm.ts accept another organization’s serverId without an activeOrganizationId ownership check, and...

CVE-2026-72876

Dokploy (free self-hosted PaaS) contains a high-severity vulnerability prior to 0.29.13 where cross-organization checks fail in swarm endpoints (swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, swarm.getAppInfos) and getNodeInfo interpolates nodeId into execAsyncRemote. This allows a caller ...

CVE-2026-72873

Dokploy prior to v0.29.13 exposes Git provider secrets (githubClientSecret, githubPrivateKey, githubWebhookSecret) to users with only service:read by returning provider relations in application.one without redaction. Affected code paths: application.one in apps/dokploy/server/api/routers/applicat...

CVE-2026-71965 CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code execution vulnerability in the remote backup feature that allows authenticated attackers to gain root-level SSH access by supplying a malicious remote server address. Attackers can exploit the unverified SSH public k...

CVE-2026-71965

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code execution vulnerability in the remote backup feature that allows authenticated attackers to gain root-level SSH access by supplying a malicious remote server address. Attackers can exploit the unverified SSH public k...

CVE-2026-72872 Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone`

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validation and cloneBitbucketRepository in packages/server/src/utils/providers/bitbucket.ts interpolates those values into git clo...

CVE-2026-72872

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validation and cloneBitbucketRepository in packages/server/src/utils/providers/bitbucket.ts interpolates those values into git clo...

EUVD-2026-55731

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts ghinit organizationId and userId values from the state parameter and calls createGithub in...

CVE-2026-72871

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts ghinit organizationId and userId values from the state parameter and calls createGithub in...

CVE-2026-72868

Dokploy prior to v0.29.13 is vulnerable: destination.testConnection fields are interpolated into an rclone ls command executed via child_process.exec, enabling a low-privileged member with destination:create permission to craft arguments and execute arbitrary commands in the Dokploy container, wh...

CVE-2026-72868

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, secretAccessKey, region, endpoint, provider, and bucket fields from destination.testConnection into an rclone ls command executed through...

CVE-2026-72866 WebSocket Terminal Auth Bypass

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the WebSocket handler in apps/dokploy/server/wss/terminal.ts validates a session but does not authorize access to the requested server. An authenticated user can connect to /terminal?serverId=local, select the special...

EUVD-2026-55724

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the WebSocket handler in apps/dokploy/server/wss/terminal.ts validates a session but does not authorize access to the requested server. An authenticated user can connect to /terminal?serverId=local, select the special...

CVE-2026-72866

CVE-2026-72866 affects Dokploy PaaS. The WebSocket-based terminal handler (apps/dokploy/server/wss/terminal.ts) authenticates a session but does not authorize access to the requested server, allowing an authenticated user to connect to /terminal?serverId=local and gain an interactive terminal on ...

CVE-2026-72864 Dokploy Broken Access Control on docker-container-terminal WebSocket (Member -> Root in Arbitrary Containers)

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the local branch of /docker-container-terminal in apps/dokploy/server/wss/docker-container-terminal.ts authenticates with validateRequest but does not authorize the attacker-controlled containerId against the caller's...

CVE-2026-72864

CVE-2026-72864 affects Dokploy (= 0.29.13 or apply vendor-provided fixes. If present, references include Dokploy advisories and release notes.

CVE-2026-72863

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy's WebSocket handlers in-app terminals and log streamers authenticate the session but never authorize it. They establish who the user is via validateRequest and then proceed without consulting the role/permissio...