EUVD-2026-55724Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Scope Changed because obtaining an interactive shell on the underlying host OS clearly transcends the Dokploy application boundary; PR:L reflects the minimum authenticated account requirement.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handler in apps/dokploy/server/wss/terminal.ts validates a session but does not authorize access to the requested server. An authenticated user can connect to /terminal?serverId=local, select the special serverId=local branch, and obtain an interactive terminal on the Dokploy host without an organization role or server-access check. This issue is fixed in version 0.29.13.
AnalysisAI
Interactive host-shell access in Dokploy prior to 0.29.13 is obtainable by any authenticated platform user due to a missing authorization check in the WebSocket terminal handler. The handler at apps/dokploy/server/wss/terminal.ts validates the session token but never checks whether the user holds an organization role or server-access grant before spawning a terminal for serverId=local, yielding full interactive shell access on the Dokploy host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must possess a valid authenticated session on the target Dokploy instance - any role, including the lowest-privilege member role, is sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.8 is well-calibrated: AV:N/AC:L/PR:L/UI:N reflects a low-friction, fully network-exploitable attack requiring only a valid authenticated account with no special conditions, and the C:H/I:H/A:H impact is accurate given that a successful attacker receives an interactive shell on the Dokploy host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated but low-privileged Dokploy member (for example, a developer with access to only one application) connects directly to the Dokploy WebSocket endpoint at wss://<host>/terminal?serverId=local using their valid session token and any standard WebSocket client. The terminal handler validates the session but omits the role check for the local path, immediately returning an interactive shell on the Dokploy host. … |
| Remediation | Upgrade Dokploy to version 0.29.13 or later, which is the vendor-confirmed fixed release introducing proper WebSocket authorization via canAccessTerminalOverWss. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Dokploy deployments and document current versions; immediately disable or isolate WebSocket terminal access for non-administrative users through configuration or network controls. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Dokploy self-hosted PaaS prior to 0.26.6 has a critical command injection vulnerability (CVSS 9.9) allowing authenticate
Dokploy versions before 0.26.6 contain hardcoded database credentials in the installation script, causing nearly all dep
Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated low-privilege member run arbitrary
Remote code execution in Dokploy 0.27.0 through 0.29.2 allows unauthenticated attackers to forge email-verification JWTs
Command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user run arbitrary OS commands on
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets a low-privileged team member with service-deploym
Command injection in Dokploy self-hosted PaaS before 0.29.13 lets a low-privileged organization member run arbitrary OS
OS command injection in Dokploy (self-hosted PaaS) version 0.28.8 and earlier lets an authenticated user with permission
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated user with the backup:restore per
OS command injection in Dokploy self-hosted PaaS prior to 0.29.13 lets an authenticated project member with compose writ
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today