What is the CVSS score of CVE-2026-72866?

CVE-2026-72866 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Dokploy are affected by CVE-2026-72866?

Dokploy versions prior to 0.29.13 contain a missing authorization check in the terminal WebSocket handler that allows any authenticated platform user to obtain unrestricted interactive shell access…. A patch is available.

How to fix or mitigate CVE-2026-72866?

Within 24 hours, identify all Dokploy deployments and document current versions; immediately disable or isolate WebSocket terminal access for non-administrative users through configuration or network controls. Within 7 days, audit all authenticated platform user accounts for suspicious terminal session activity and unauthorized shell command execution; review audit logs for evidence of exploitation; implement network-level access controls restricting WebSocket terminal requests to trusted administrative networks only. Within 30 days, minimize the set of platform users with terminal access to only those requiring it; implement application-level role-based authorization checks on the terminal handler; continuously monitor vendor advisories and the Dokploy repository for patch availability and prioritize rapid deployment upon release.

Dokploy CVE-2026-72866

EUVD-2026-55724 HIGH

Missing Authorization (CWE-862)

2026-08-10 GitHub_M

Authentication Bypass Dokploy

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Scope Changed because obtaining an interactive shell on the underlying host OS clearly transcends the Dokploy application boundary; PR:L reflects the minimum authenticated account requirement.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 10, 2026 - 20:04 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 19:27 vuln.today

Analysis Generated

Aug 10, 2026 - 19:27 vuln.today

CVE Published

Aug 10, 2026 - 18:34 cve.org

HIGH 8.8

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handler in apps/dokploy/server/wss/terminal.ts validates a session but does not authorize access to the requested server. An authenticated user can connect to /terminal?serverId=local, select the special serverId=local branch, and obtain an interactive terminal on the Dokploy host without an organization role or server-access check. This issue is fixed in version 0.29.13.

AnalysisAI

Interactive host-shell access in Dokploy prior to 0.29.13 is obtainable by any authenticated platform user due to a missing authorization check in the WebSocket terminal handler. The handler at apps/dokploy/server/wss/terminal.ts validates the session token but never checks whether the user holds an organization role or server-access grant before spawning a terminal for serverId=local, yielding full interactive shell access on the Dokploy host. No confirmed active exploitation or public exploit code has been identified at time of analysis, but the public security advisory and fix diff make reconstruction trivial for any authenticated user.

Technical ContextAI

Dokploy is an open-source, self-hostable Node.js PaaS, affected across all versions per CPE cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:*. The vulnerable component is the WebSocket handler apps/dokploy/server/wss/terminal.ts, which manages real-time terminal sessions over WebSocket. The root cause is CWE-862 (Missing Authorization): the handler correctly validates the session cookie or token (authentication) but entirely omits authorization - specifically, it never verifies that the caller holds an owner or admin organization role before granting a terminal on the local Dokploy host. The fix introduced in PR #4865 (commit 68f5afae) adds a canAccessTerminalOverWss function that explicitly gates the serverId=local path to owner and admin roles, and gates remote server terminal access to explicitly granted server IDs, as confirmed by the accompanying test suite in authorize.test.ts.

RemediationAI

Upgrade Dokploy to version 0.29.13 or later, which is the vendor-confirmed fixed release introducing proper WebSocket authorization via canAccessTerminalOverWss. The fix is verified in commit 68f5afae42fca353dcb3d3bc6219ffe9e168cb91 and tagged at https://github.com/Dokploy/dokploy/releases/tag/v0.29.13. For deployments that cannot immediately upgrade, restrict network access to the Dokploy management interface to trusted IP ranges or a VPN, which prevents unauthenticated external actors from obtaining accounts and removes the ability for remote exploitation - note this is a network-layer control and does not address the authorization flaw itself. Additionally, audit the Dokploy user roster and remove or demote accounts that do not require host-level access; reducing the number of accounts to the minimum necessary limits the exploitable attack surface until the patch is applied.