CVE-2026-72876
Dokploy is a free, self-hostable Platform as a Service (PaaS).
Impact
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in apps/dokploy/server/api/routers/swarm.ts accept another organization’s serverId without an activeOrganizationId ownership check, and getNodeInfo in packages/server/src/services/docker.ts interpolates nodeId into execAsyncRemote, allowing a caller with server:read permission to execute arbitrary commands as the configured SSH user on another tenant’s server. This issue is fixed in version 0.29.13.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/Dokploy/dokploy/commit/5563699f71b2058b49eebdfd66c6c3dbd92ede9c
- https://github.com/Dokploy/dokploy/pull/4858
- https://github.com/Dokploy/dokploy/releases/tag/v0.29.13
- https://github.com/Dokploy/dokploy/security/advisories/GHSA-jj6h-388v-9rwm
- https://github.com/Dokploy/dokploy/security/advisories/GHSA-jj6h-388v-9rwm