What is the CVSS score of CVE-2026-72871?

CVE-2026-72871 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Dokploy are affected by CVE-2026-72871?

Dokploy PaaS versions prior to v0.29.13 allow remote attackers to inject arbitrary GitHub App credentials into any organization's configuration via forged OAuth state parameters.. A patch is available.

How to fix or mitigate CVE-2026-72871?

Within 24 hours, verify your Dokploy PaaS version and immediately audit all GitHub App provider configurations for unauthorized credentials. Within 7 days, upgrade all instances to v0.29.13 or later. Within 30 days, comprehensively review deployment logs spanning when the vulnerable version was active to identify exploitation attempts, and rotate all GitHub App credentials as a precautionary measure.

Dokploy CVE-2026-72871

EUVD-2026-55731 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-08-10 GitHub_M

Authentication Bypass Dokploy

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Route is entirely unauthenticated (PR:N) and exploitable over the network with trivial complexity (AV:N/AC:L); direct impact is integrity-only as attacker writes to victim org config without reading protected data.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Aug 10, 2026 - 20:04 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 19:24 vuln.today

Analysis Generated

Aug 10, 2026 - 19:24 vuln.today

CVE Published

Aug 10, 2026 - 18:47 cve.org

HIGH 7.5

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts gh_init organizationId and userId values from the state parameter and calls createGithub in packages/server/src/services/github.ts, allowing an attacker to insert a GitHub App provider containing client_secret, webhook_secret, and PEM private key material into another organization. This issue is fixed in version 0.29.13.

AnalysisAI

GitHub App provider injection in Dokploy PaaS (prior to v0.29.13) allows unauthenticated remote attackers to insert attacker-controlled GitHub App credentials - including client_secret, webhook_secret, and PEM private key material - into any target organization's configuration by forging the state parameter in the GitHub OAuth callback route. The route /api/providers/github/setup performed no session authentication (CWE-306), blindly trusting organizationId and userId values supplied by the caller in the state query parameter. No public exploit identified at time of analysis; a vendor-released patch is confirmed available as v0.29.13.

Technical ContextAI

The vulnerable endpoint apps/dokploy/pages/api/providers/github/setup.ts implements the server-side OAuth callback for GitHub App installation. In standard OAuth flows, the state parameter is a server-generated opaque nonce used to prevent CSRF; Dokploy's broken implementation instead parsed state as a colon-delimited payload containing action, organizationId, and userId - all attacker-controlled values with no server-side verification. Because the route required no authentication, any unauthenticated HTTP client could craft a request with arbitrary organization and user identifiers and trigger createGithub() in packages/server/src/services/github.ts, inserting a GitHub App record under the victim organization. The root cause is CWE-306 (Missing Authentication for Critical Function). The fix in PR #4870 (commit 5ae344db) adds validateRequest(req) for session validation, derives organization and user context exclusively from the authenticated session object, and gates the action behind hasPermission() requiring gitProviders:create rights, removing all trust in the state parameter for identity resolution. Affected CPE: cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to Dokploy v0.29.13 or later, available at https://github.com/Dokploy/dokploy/releases/tag/v0.29.13; this version introduces session-based authentication and explicit permission checks on the GitHub setup callback route, eliminating trust in attacker-supplied state parameter values. If immediate upgrade is not feasible, restrict network access to the /api/providers/github/setup endpoint at the reverse proxy or firewall layer so only trusted internal networks can reach it - this trades off the ability for remote GitHub OAuth redirects to complete automatically but prevents unauthenticated exploitation from the internet. Operators should also audit existing GitHub App provider records in the Dokploy database for entries with unexpected credentials or mismatched organizationId/userId associations, as these may indicate prior exploitation. Full advisory details are at https://github.com/Dokploy/dokploy/security/advisories/GHSA-g9pp-xcf2-ph7x.