EUVD-2026-55680Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Network-exploitable API (AV:N); AC:H because serverId of a foreign org must be known in advance; PR:L for authenticated org admin; scope change crosses org boundaries yielding SSH key (C:H) and server deletion (I:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Lifecycle Timeline
4DescriptionCVE.org
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.28.7 until 0.29.13, the server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId and calls haveActiveServices, findServerById, removeDeploymentsByServerId, and deleteServer without verifying that currentServer.organizationId equals ctx.session.activeOrganizationId. An authenticated owner or administrator with server:delete in one organization who previously observed another organization's serverId can delete that organization's server registration and deployment records, interrupt Dokploy management, and receive the associated plaintext SSH private key even though server.one denies the same cross-organization read. This issue is fixed in version 0.29.13.
AnalysisAI
Cross-organization server deletion and SSH key disclosure in Dokploy affects all instances running versions 0.28.7 through 0.29.12. The server.remove tRPC mutation accepts a caller-supplied serverId without verifying organizational ownership, allowing an authenticated owner or administrator in one organization to delete server registrations and all associated deployment records belonging to a completely separate organization - and to receive that organization's plaintext SSH private key as a side effect. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated user holding owner or administrator role with server:delete permission within their own Dokploy organization - unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.4 score with a Scope:Changed vector reflects that exploitation crosses organizational trust boundaries, which is the primary driver of severity here. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated administrator in Organization A, who has legitimately managed servers within their own tenant, discovers or enumerates a serverId belonging to Organization B - for example by monitoring API responses during legitimate use or through an IDOR scan of sequential/guessable IDs. They issue a server.remove call with Organization B's serverId; the API validates only that they hold server:delete within their own org, performs no ownership check, deletes Organization B's server record and all deployment metadata, and returns the associated SSH private key in plaintext. … |
| Remediation | Upgrade to Dokploy version 0.29.13, which introduces an explicit organizationId ownership check in the server.remove mutation before any destructive operations proceed - confirmed by the patch at commit 4aee66b2d1dc2c027749a541e553aa49947075c1 and PR #4874 (https://github.com/Dokploy/dokploy/pull/4874). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running Dokploy versions 0.28.7 through 0.29.12 and assess exposure window; brief senior leadership on the cross-organization access risk and prepare stakeholders for emergency patching. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Dokploy self-hosted PaaS prior to 0.26.6 has a critical command injection vulnerability (CVSS 9.9) allowing authenticate
Dokploy versions before 0.26.6 contain hardcoded database credentials in the installation script, causing nearly all dep
Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated low-privilege member run arbitrary
Remote code execution in Dokploy 0.27.0 through 0.29.2 allows unauthenticated attackers to forge email-verification JWTs
Command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user run arbitrary OS commands on
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets a low-privileged team member with service-deploym
Command injection in Dokploy self-hosted PaaS before 0.29.13 lets a low-privileged organization member run arbitrary OS
OS command injection in Dokploy (self-hosted PaaS) version 0.28.8 and earlier lets an authenticated user with permission
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated user with the backup:restore per
OS command injection in Dokploy self-hosted PaaS prior to 0.29.13 lets an authenticated project member with compose writ
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today