Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-72876: Dokploy: Malicious Tenant Can Access Another's Server
CVE-2026-72876
CVE-2026-72876
Summary
Dokploy's self-hosted servers allow a malicious tenant with server access to execute arbitrary commands on another tenant's server. This is a serious security risk, as it could allow unauthorized access to sensitive data. To fix this issue, update Dokploy to version 0.29.13 or later.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| dokploy | dokploy | < 0.29.13 |
Original title
Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.*
Original description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in apps/dokploy/server/api/routers/swarm.ts accept another organization’s serverId without an activeOrganizationId ownership check, and getNodeInfo in packages/server/src/services/docker.ts interpolates nodeId into execAsyncRemote, allowing a caller with server:read permission to execute arbitrary commands as the configured SSH user on another tenant’s server. This issue is fixed in version 0.29.13.
mitre CVSS3.1
9.9
Vulnerability type
CWE-78
OS Command Injection
CWE-639
Authorization Bypass Through User-Controlled Key
CWE-862
Missing Authorization
- https://github.com/Dokploy/dokploy/security/advisories/GHSA-jj6h-388v-9rwm x_refsource_CONFIRM
- https://github.com/Dokploy/dokploy/pull/4858 x_refsource_MISC
- https://github.com/Dokploy/dokploy/commit/5563699f71b2058b49eebdfd66c6c3dbd92ede... x_refsource_MISC
- https://github.com/Dokploy/dokploy/releases/tag/v0.29.13 x_refsource_MISC
Published: 10 Aug 2026 · Updated: 10 Aug 2026 · First seen: 10 Aug 2026