What is the CVSS score of EUVD-2026-55722?

EUVD-2026-55722 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Dokploy are affected by EUVD-2026-55722?

Dokploy 0.29.12 and earlier allow any authenticated organization member to gain full administrative control over arbitrary containers, bypassing authorization protections.. A patch is available.

How to fix or mitigate EUVD-2026-55722?

Within 24 hours, identify all running Dokploy instances and document which are exposed to multiple organization members or untrusted users; prioritize instances hosting production workloads. Within 7 days, upgrade all Dokploy deployments to version 0.29.13 or later using your standard change control process. Within 30 days, complete post-upgrade verification, review access logs for unauthorized terminal activity during the vulnerability exposure window, and implement least-privilege access controls limiting container terminal access to authorized roles only.

Dokploy EUVD-2026-55722

| CVE-2026-72864 CRITICAL

Missing Authorization (CWE-862)

2026-08-10 GitHub_M

Authentication Bypass Docker Dokploy

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable WebSocket, trivial to trigger, requires only a low-privilege member (PR:L), no interaction; scope changes as the auth flaw yields root in other containers, giving full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 10, 2026 - 20:04 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 19:27 vuln.today

Analysis Generated

Aug 10, 2026 - 19:27 vuln.today

CVE Published

Aug 10, 2026 - 18:31 cve.org

CRITICAL 9.9

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the local branch of /docker-container-terminal in apps/dokploy/server/wss/docker-container-terminal.ts authenticates with validateRequest but does not authorize the attacker-controlled containerId against the caller's role, organization, or service access before passing it to docker exec, allowing any authenticated member to obtain a root shell in arbitrary containers on a self-hosted instance. This issue is fixed in version 0.29.13.

Articles & Coverage 1

News Critical Privilege Escalation in Dokploy PaaS (Docker) - CVE-2026-72864 Aug 10, 2026

AnalysisAI

Privilege escalation via missing authorization in Dokploy, a self-hostable Platform-as-a-Service, lets any authenticated organization member open a root shell inside arbitrary containers on a self-hosted instance. The /docker-container-terminal WebSocket handler authenticated the caller but never checked the attacker-supplied containerId against the caller's role, organization, or service scope before invoking docker exec. Fixed in 0.29.13; no public exploit identified at time of analysis, though the upstream fix commit is public.

Technical ContextAI

Dokploy exposes container terminals over WebSockets (apps/dokploy/server/wss/docker-container-terminal.ts). The flaw is a classic CWE-862 Missing Authorization: validateRequest confirmed a valid session but no downstream check tied the requested containerId to what that member is actually permitted to touch, and the value flowed straight into docker exec. Because docker exec attaches into a target container as its running user (typically root), a successful call yields an interactive root shell in any container the Docker daemon manages. The remediation introduces a dedicated authorizer (canAccessDockerOverWss / canAccessTerminalOverWss) enforcing the docker permission and, for remote servers, server-access scoping via getAccessibleServerIds, with the local host terminal restricted to owner/admin.

RemediationAI

Vendor-released patch: 0.29.13 - upgrade to Dokploy 0.29.13 or later, which adds explicit WebSocket authorization for container/docker operations (see the advisory GHSA-899j-cjwp-v4gw and release https://github.com/Dokploy/dokploy/releases/tag/v0.29.13). If you cannot patch immediately, reduce the trusted membership surface: remove or downgrade any organization members who do not strictly need docker/terminal access, since exploitation requires an authenticated member, and restrict network access to the Dokploy control-plane UI/WebSocket endpoint to trusted administrators via firewall or reverse-proxy allowlisting - the trade-off is that legitimate remote members lose console access until patched. Avoid granting new member accounts on shared instances until upgraded. These are stopgaps only; the code-level authorization fix in 0.29.13 is the real remedy.