EUVD-2026-55680Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Network-exploitable API (AV:N); AC:H because serverId of a foreign org must be known in advance; PR:L for authenticated org admin; scope change crosses org boundaries yielding SSH key (C:H) and server deletion (I:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.28.7 until 0.29.13, the server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId and calls haveActiveServices, findServerById, removeDeploymentsByServerId, and deleteServer without verifying that currentServer.organizationId equals ctx.session.activeOrganizationId. An authenticated owner or administrator with server:delete in one organization who previously observed another organization's serverId can delete that organization's server registration and deployment records, interrupt Dokploy management, and receive the associated plaintext SSH private key even though server.one denies the same cross-organization read. This issue is fixed in version 0.29.13.
AnalysisAI
Cross-organization server deletion and SSH key disclosure in Dokploy affects all instances running versions 0.28.7 through 0.29.12. The server.remove tRPC mutation accepts a caller-supplied serverId without verifying organizational ownership, allowing an authenticated owner or administrator in one organization to delete server registrations and all associated deployment records belonging to a completely separate organization - and to receive that organization's plaintext SSH private key as a side effect. No public exploit code has been identified at time of analysis, but the fix is available in version 0.29.13 and the GitHub advisory (GHSA-3rpx-c3j9-q99x) and patch PR are public.
Technical ContextAI
Dokploy is an open-source, self-hostable PaaS built on a tRPC API stack. The affected endpoint is the server.remove mutation in apps/dokploy/server/api/routers/server.ts. This mutation accepted a caller-controlled serverId parameter and invoked haveActiveServices, findServerById, removeDeploymentsByServerId, and deleteServer in sequence without ever confirming that the server's organizationId matched the caller's active organization (ctx.session.activeOrganizationId). CWE-639 (Authorization Bypass Through User-Controlled Key) precisely describes this root cause: the application uses an attacker-influenced identifier to look up a resource without enforcing ownership. The CPE is cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:*, covering all versions in the affected range. Notably, the server.one read endpoint correctly enforced cross-organization isolation - only the delete path was unprotected, creating an asymmetry where read was denied but destructive write was permitted.
RemediationAI
Upgrade to Dokploy version 0.29.13, which introduces an explicit organizationId ownership check in the server.remove mutation before any destructive operations proceed - confirmed by the patch at commit 4aee66b2d1dc2c027749a541e553aa49947075c1 and PR #4874 (https://github.com/Dokploy/dokploy/pull/4874). The release is tagged at https://github.com/Dokploy/dokploy/releases/tag/v0.29.13. If immediate upgrade is not possible and the deployment hosts multiple untrusted organizations, the most effective compensating control is to ensure each organization is provisioned on a completely separate Dokploy instance rather than sharing one - this eliminates the cross-organization attack surface entirely, though at the cost of increased operational overhead. Restricting the server:delete permission to a minimal set of fully trusted administrators within each organization also limits exposure but does not eliminate it, since any such administrator could still exploit the flaw. Rotating all SSH private keys managed by Dokploy is advisable for any deployment where the serverId values may have been observable across organizational contexts.
Dokploy self-hosted PaaS prior to 0.26.6 has a critical command injection vulnerability (CVSS 9.9) allowing authenticate
Dokploy versions before 0.26.6 contain hardcoded database credentials in the installation script, causing nearly all dep
Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated low-privilege member run arbitrary
Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated panel user run arbitrary commands o
Remote code execution in Dokploy 0.27.0 through 0.29.2 allows unauthenticated attackers to forge email-verification JWTs
Command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user run arbitrary OS commands on
OS command injection in Dokploy self-hosted PaaS before 0.29.13 lets an authenticated member with service-deployment per
Command injection in Dokploy self-hostable PaaS before 0.29.13 lets an authenticated user with backup:read permission ru
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
OS command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user holding the backup-restor
Cross-tenant remote command execution in Dokploy (self-hosted PaaS) before 0.29.13 lets any authenticated user holding o
Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today