EUVD-2026-55797Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network tRPC API with low-complexity calls, only a low-privilege member account (PR:L), no interaction, and escalation from tenant context to root on the host (S:C) fully compromising C/I/A.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.2 until 0.29.13, schedule.create and schedule.update in apps/dokploy/server/api/routers/schedule.ts derive serviceId from applicationId or composeId and execute the owner/admin host-schedule gate only in the alternative branch, allowing a member with access to one application to attach its applicationId to a dokploy-server schedule and run a supplied script as root through schedule.runManually. This issue is fixed in version 0.29.13.
AnalysisAI
Privilege escalation to root in Dokploy (self-hosted PaaS) versions 0.29.2 through 0.29.12 lets a low-privilege organization member who has access to a single application escalate to full host command execution. Because schedule.create/schedule.update derive the internal serviceId from applicationId or composeId but only enforce the owner/admin host-schedule gate in the alternate branch, a member can bind their applicationId to a 'dokploy-server' (host-level) schedule and execute an arbitrary supplied script as root via schedule.runManually. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Dokploy organization member account (PR:L) that has access to at least one application (to supply a valid applicationId) or compose project (composeId). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) is well-supported by the description: a network-reachable API, low attack complexity, only low-privilege (member) authentication needed, no user interaction, and a scope change from application-tenant context to root code execution on the underlying host - an unusually clean privilege-escalation-to-host primitive that fully compromises confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A contractor is invited as a Dokploy organization member and given access to a single non-critical application. Using that application's applicationId, they call schedule.create with scheduleType 'dokploy-server' and a malicious shell script, bypassing the owner/admin gate, then invoke schedule.runManually to execute their script as root on the Dokploy host - taking over the server and every other tenant's containers. … |
| Remediation | Vendor-released patch: upgrade to Dokploy 0.29.13, which introduces the centralized assertHostScheduleAccess gate across schedule create, update, and run (release: https://github.com/Dokploy/dokploy/releases/tag/v0.29.13; fix PR https://github.com/Dokploy/dokploy/pull/4869; commit 1e3f10bd22c1c28a7b65a2d7ac15a0a5e47599eb). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: locate all Dokploy instances and document their versions, then create an inventory of users with application-level access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Dokploy self-hosted PaaS prior to 0.26.6 has a critical command injection vulnerability (CVSS 9.9) allowing authenticate
Dokploy versions before 0.26.6 contain hardcoded database credentials in the installation script, causing nearly all dep
Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated low-privilege member run arbitrary
Remote code execution in Dokploy 0.27.0 through 0.29.2 allows unauthenticated attackers to forge email-verification JWTs
Command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user run arbitrary OS commands on
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets a low-privileged team member with service-deploym
Command injection in Dokploy self-hosted PaaS before 0.29.13 lets a low-privileged organization member run arbitrary OS
OS command injection in Dokploy (self-hosted PaaS) version 0.28.8 and earlier lets an authenticated user with permission
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated user with the backup:restore per
OS command injection in Dokploy self-hosted PaaS prior to 0.29.13 lets an authenticated project member with compose writ
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today