What is the CVSS score of CVE-2026-72886?

CVE-2026-72886 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Dokploy are affected by CVE-2026-72886?

Dokploy self-hosted PaaS versions 0.29.2-0.29.12 allow low-privilege application team members to achieve root-level command execution across the entire host infrastructure.. A patch is available.

How to fix or mitigate CVE-2026-72886?

Within 24 hours: locate all Dokploy instances and document their versions, then create an inventory of users with application-level access. Within 7 days: upgrade to Dokploy 0.29.13 or later as indicated in vendor documentation; if immediate upgrade is blocked, immediately revoke non-administrative permissions for application creation and schedule management while enabling detailed API audit logging. Within 30 days: complete upgrade to version 0.29.13+ across all environments, analyze audit logs for any exploitation attempts, and verify no unauthorized host-level scheduled jobs exist.

Dokploy CVE-2026-72886

EUVD-2026-55797 CRITICAL

Improper Privilege Management (CWE-269)

2026-08-10 GitHub_M

Privilege Escalation Dokploy

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network tRPC API with low-complexity calls, only a low-privilege member account (PR:L), no interaction, and escalation from tenant context to root on the host (S:C) fully compromising C/I/A.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 10, 2026 - 21:05 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 20:06 vuln.today

Analysis Generated

Aug 10, 2026 - 20:06 vuln.today

CVE Published

Aug 10, 2026 - 19:38 cve.org

CRITICAL 9.9

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.2 until 0.29.13, schedule.create and schedule.update in apps/dokploy/server/api/routers/schedule.ts derive serviceId from applicationId or composeId and execute the owner/admin host-schedule gate only in the alternative branch, allowing a member with access to one application to attach its applicationId to a dokploy-server schedule and run a supplied script as root through schedule.runManually. This issue is fixed in version 0.29.13.

AnalysisAI

Privilege escalation to root in Dokploy (self-hosted PaaS) versions 0.29.2 through 0.29.12 lets a low-privilege organization member who has access to a single application escalate to full host command execution. Because schedule.create/schedule.update derive the internal serviceId from applicationId or composeId but only enforce the owner/admin host-schedule gate in the alternate branch, a member can bind their applicationId to a 'dokploy-server' (host-level) schedule and execute an arbitrary supplied script as root via schedule.runManually. No public exploit identified at time of analysis; fixed in 0.29.13.

Technical ContextAI

Dokploy is a Node.js/TypeScript, self-hostable Heroku/Vercel-style Platform-as-a-Service that manages applications, Docker Compose stacks, and host servers, exposing its API through tRPC routers. The flaw lives in apps/dokploy/server/api/routers/schedule.ts, where 'scheduleType' can be application, compose, server, or 'dokploy-server' (the Dokploy host itself). The root cause is CWE-269 (Improper Privilege Management): the authorization logic branched on how serviceId was resolved, so the owner/admin gate and organization ownership checks that should protect host-level ('server'/'dokploy-server') schedules were reachable only in one code path, leaving the applicationId-driven path ungated. The fix centralizes enforcement into a single assertHostScheduleAccess(ctx, scheduleType, serverId) helper invoked in create, update, and run paths. The affected component is cpe:2.3:a:dokploy:dokploy across all versions in the 0.29.2-0.29.12 range.

RemediationAI

Vendor-released patch: upgrade to Dokploy 0.29.13, which introduces the centralized assertHostScheduleAccess gate across schedule create, update, and run (release: https://github.com/Dokploy/dokploy/releases/tag/v0.29.13; fix PR https://github.com/Dokploy/dokploy/pull/4869; commit 1e3f10bd22c1c28a7b65a2d7ac15a0a5e47599eb). Until you can upgrade, reduce exposure by not granting organization membership to untrusted users and by keeping every member at owner/admin only where you fully trust them (the vulnerability lets any lower-privilege member reach host execution, so restricting who has member accounts directly limits the attack surface); where feasible, avoid using host-level ('dokploy-server') schedules and audit existing schedules and their runManually usage for scripts you did not create. These are stopgaps with the trade-off of reduced delegation and collaboration - they do not fully close the code-path gap, so patching to 0.29.13 remains the only complete fix. Details: https://github.com/Dokploy/dokploy/security/advisories/GHSA-r89g-h7x9-phr2.