EUVD-2026-55731Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Route is entirely unauthenticated (PR:N) and exploitable over the network with trivial complexity (AV:N/AC:L); direct impact is integrity-only as attacker writes to victim org config without reading protected data.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts gh_init organizationId and userId values from the state parameter and calls createGithub in packages/server/src/services/github.ts, allowing an attacker to insert a GitHub App provider containing client_secret, webhook_secret, and PEM private key material into another organization. This issue is fixed in version 0.29.13.
AnalysisAI
GitHub App provider injection in Dokploy PaaS (prior to v0.29.13) allows unauthenticated remote attackers to insert attacker-controlled GitHub App credentials - including client_secret, webhook_secret, and PEM private key material - into any target organization's configuration by forging the state parameter in the GitHub OAuth callback route. The route /api/providers/github/setup performed no session authentication (CWE-306), blindly trusting organizationId and userId values supplied by the caller in the state query parameter. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The route /api/providers/github/setup must be reachable over the network - no authentication is required by design in vulnerable versions, as the entire flaw is the complete absence of a session check on a state-mutating endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) is consistent with the vulnerability mechanics: the route is entirely unauthenticated, requires no special network position, and the attack is low-complexity - construct a state parameter encoding a target organizationId and send an HTTP GET. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targeting an internet-exposed Dokploy instance sends a crafted GET request to /api/providers/github/setup with a state parameter encoding gh_init, a target organizationId obtained via enumeration or reconnaissance, and an arbitrary userId alongside a pre-registered attacker-controlled GitHub App. The Dokploy server, performing no authentication check, calls createGithub and inserts the malicious provider record under the victim organization. … |
| Remediation | Upgrade to Dokploy v0.29.13 or later, available at https://github.com/Dokploy/dokploy/releases/tag/v0.29.13; this version introduces session-based authentication and explicit permission checks on the GitHub setup callback route, eliminating trust in attacker-supplied state parameter values. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, verify your Dokploy PaaS version and immediately audit all GitHub App provider configurations for unauthorized credentials. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Dokploy self-hosted PaaS prior to 0.26.6 has a critical command injection vulnerability (CVSS 9.9) allowing authenticate
Dokploy versions before 0.26.6 contain hardcoded database credentials in the installation script, causing nearly all dep
Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated low-privilege member run arbitrary
Remote code execution in Dokploy 0.27.0 through 0.29.2 allows unauthenticated attackers to forge email-verification JWTs
Command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user run arbitrary OS commands on
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets a low-privileged team member with service-deploym
Command injection in Dokploy self-hosted PaaS before 0.29.13 lets a low-privileged organization member run arbitrary OS
OS command injection in Dokploy (self-hosted PaaS) version 0.28.8 and earlier lets an authenticated user with permission
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated user with the backup:restore per
OS command injection in Dokploy self-hosted PaaS prior to 0.29.13 lets an authenticated project member with compose writ
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today