CVE Feed

    Dashboard / CVE / CVE-2026-72876

    CVE-2026-72876

    Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in apps/dokploy/server/api/routers/swarm.ts accept another organization’s serverId without an activeOrganizationId ownership check, and getNodeInfo in packages/server/src/services/docker.ts interpolates nodeId into execAsyncRemote, allowing a caller with server:read permission to execute arbitrary commands as the configured SSH user on another tenant’s server. This issue is fixed in version 0.29.13.

    Published:Aug 10, 2026
    Last Modified:Aug 11, 2026
    EPS:Aug 10, 2026
    EPSS Score:
    CVSS Score:9.9

    Affected Products

    Vendor
    Dokploy
    Product
    Dokploy

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-82954 (CVSS 8.6) — A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath…
    CVE-2026-45791 (CVSS 5.9) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedur…
    CVE-2026-45790 (CVSS 8) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's organization.inviteM…
    CVE-2026-72902 (CVSS 9.9) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticat…
    CVE-2026-72901 (CVSS 9.9) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticat…
    CVE-2026-72886 (CVSS 9.9) — Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.2 until 0.29.13, schedule.create and …
    CVE-2026-72885 (CVSS 0) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, dockerContextPath accepted by…
    CVE-2026-72884 (CVSS 8.7) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, sanitizeCommand in packages/s…
    CVE-2026-72883 (CVSS 8.8) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handlers in app…
    CVE-2026-72882 (CVSS 9.9) — Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, an authenticated user wh…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High