Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

CVE-2026-72864: Dokploy: Attacker Can Access Any Container on Your Server

CVE-2026-72864 CVE-2026-72864
Summary

Dokploy, a self-hosted Platform as a Service, has a security issue that allows any authenticated user to access and control any container on your server. This is a serious risk because it could lead to unauthorized changes or even a complete takeover of your server. To fix this, update Dokploy to version 0.29.13 or later.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software
VendorProductAffected versions
dokploy dokploy < 0.29.13
Original title
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the local branch of /docker-container-terminal in apps/dokploy/server/wss/docker-container-terminal.ts authenticates...
Original description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the local branch of /docker-container-terminal in apps/dokploy/server/wss/docker-container-terminal.ts authenticates with validateRequest but does not authorize the attacker-controlled containerId against the caller's role, organization, or service access before passing it to `docker exec`, allowing any authenticated member to obtain a root shell in arbitrary containers on a self-hosted instance. This issue is fixed in version 0.29.13.
mitre CVSS3.1 9.9
Vulnerability type
CWE-862 Missing Authorization
Published: 10 Aug 2026 · Updated: 10 Aug 2026 · First seen: 10 Aug 2026