What is the CVSS score of EUVD-2026-55703?

EUVD-2026-55703 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Dokploy are affected by EUVD-2026-55703?

Dokploy self-hosted PaaS versions prior to 0.29.13 contain a critical privilege escalation flaw in WebSocket terminal handlers that allows any authenticated organization member to obtain root access…. A patch is available.

How to fix or mitigate EUVD-2026-55703?

Within 24 hours, inventory all Dokploy deployments and document current versions; immediately restrict terminal/log-streaming access to privileged roles only as interim mitigation. Within 7 days, upgrade all instances to Dokploy 0.29.13 or later and validate the upgrade in a staging environment first; simultaneously audit WebSocket handler logs for unauthorized session hijacking attempts during the vulnerability window. Within 30 days, conduct a full security assessment of tenant isolation controls, verify no unauthorized cross-tenant access occurred, and establish quarterly patch-cycle reviews for PaaS infrastructure.

Dokploy EUVD-2026-55703

| CVE-2026-72863 CRITICAL

Improper Privilege Management (CWE-269)

2026-08-10 GitHub_M

Privilege Escalation Docker Dokploy

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable WebSocket needing only a low-privileged member (PR:L) and no interaction; the app-to-host Docker-socket escape justifies S:C with full C/I/A high.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Aug 10, 2026 - 19:20 vuln.today

Analysis Generated

Aug 10, 2026 - 19:20 vuln.today

Patch available

Aug 10, 2026 - 19:03 EUVD

CVE Published

Aug 10, 2026 - 18:28 cve.org

CRITICAL 9.9

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's WebSocket handlers (in-app terminals and log streamers) authenticate the session but never authorize it. They establish who the user is via validateRequest() and then proceed without consulting the role/permission model that every tRPC procedure enforces. Any authenticated member, can therefore open an interactive shell into any container on the host, including the dokploy container that mounts the Docker socket, and from there obtain root on the host, escaping the application and crossing every tenant boundary. This vulnerability is fixed in 0.29.13.

Articles & Coverage 1

News Critical Privilege Escalation in Dokploy Self-Hosted PaaS - CVE-2026-72863 Aug 11, 2026

AnalysisAI

Privilege escalation to host root in Dokploy self-hosted PaaS versions prior to 0.29.13 allows any authenticated organization member to hijack WebSocket terminal and log-streaming handlers that authenticate the session but never check the role/permission model enforced elsewhere. Because these handlers can open an interactive shell into any container - including the Dokploy container that mounts the Docker socket - a low-privileged tenant can obtain root on the host and cross every tenant boundary. No public exploit identified at time of analysis, though the upstream fix commit and a regression test are public. The CVSS is 9.9 driven by scope change and full CIA impact.

Technical ContextAI

Dokploy is a self-hostable Platform-as-a-Service (a Heroku/Vercel alternative) that manages application containers via the Docker Engine, orchestrated through a control-plane container that bind-mounts the host Docker socket. It exposes tRPC procedures for its API (which correctly enforce a role/permission model) plus separate WebSocket handlers for in-app container terminals, host SSH terminals, and log/stat streamers. The root cause maps to CWE-269 (Improper Privilege Management): the WSS handlers call validateRequest() to establish identity (authentication) but never call the authorization layer (hasPermission / findMemberByUserId / getAccessibleServerIds) that every tRPC procedure consults, so authentication was mistaken for authorization. Mounting the Docker socket means any shell into the Dokploy container is equivalent to root on the underlying host, since the Docker API can launch privileged containers. Affected CPE is cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: upgrade to Dokploy 0.29.13 (https://github.com/Dokploy/dokploy/releases/tag/v0.29.13), which adds the missing authorization layer in the WebSocket handlers as shown in commit 68f5afae42fca353dcb3d3bc6219ffe9e168cb91 and documented in advisory GHSA-7r6p-v9gw-pwc8. This is the primary and recommended fix. If you cannot upgrade immediately, reduce exposure by restricting organization membership to fully trusted operators only (removing or suspending low-privileged member accounts), and place the Dokploy web/WebSocket interface behind a network control such as a VPN or IP allowlist so only trusted operators can reach it - the trade-off is loss of self-service access for legitimate members. Where feasible, avoid running multi-tenant/multi-member organizations on a single host until patched, since the flaw crosses tenant boundaries. These are stopgaps only; the authorization gap itself can only be closed by the 0.29.13 update.