CVE-2026-116068 in Dokploy
Summary
by MITRE • 10/25/2026
Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment variables and build secrets, repoint sources, and disrupt other tenants' applications.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in Dokploy versions up to 0.30.10 represents a critical failure in access control mechanisms within the application management platform. This flaw is classified as an authorization bypass, specifically falling under CWE-284: Improper Access Control. The core technical issue stems from insufficient validation of resource ownership during API operations. When users interact with endpoints such as saveEnvironment, updateTraefikConfig, deploy, or stop, the system fails to verify that the applicationId provided in the request actually belongs to the authenticated user's organization. Instead, it relies on the presence of a valid session token associated with an owner or admin role within any tenant, allowing them to target resources outside their designated scope by supplying arbitrary foreign application identifiers.
From an operational perspective, this vulnerability enables horizontal privilege escalation where users can interfere with other tenants' applications in multi-tenant environments. An attacker possessing administrative privileges for one organization can manipulate the configuration and deployment states of applications belonging to completely separate organizations. By invoking these procedures, attackers have the capability to overwrite environment variables and build secrets, which may contain sensitive credentials or configuration data critical for application functionality. Furthermore, they can repoint source repositories, potentially injecting malicious code into the build pipeline, or disrupt ongoing deployments by stopping services unexpectedly. This leads to a severe compromise of confidentiality, integrity, and availability for affected tenants.
The impact extends beyond simple service disruption. The ability to modify environment variables and secrets poses a significant risk if those values contain database passwords, API keys, or other sensitive information that could be exfiltrated or misused in subsequent attacks. Additionally, repointing sources allows an attacker to compromise the integrity of the software supply chain for victim organizations, leading to potential malware injection or data leakage through compromised builds. This aligns with MITRE ATT&CK techniques related to Command and Control via Application Layer Protocol as well as Defense Evasion by modifying system configurations to hide malicious activity or disrupt security controls.
To mitigate this vulnerability, immediate updates to Dokploy version 0.30.11 or later are required, where the authorization logic has been corrected to strictly validate that the requesting user owns the target application resource before executing any state-changing operations. In environments where upgrading is not immediately feasible, network-level isolation between tenants and strict firewall rules limiting access to internal API endpoints can provide partial mitigation. Additionally, implementing robust logging and monitoring for unusual patterns of cross-tenant API calls can help detect exploitation attempts in real-time. Organizations should also audit their current configurations to ensure no sensitive data was exposed or altered during the window of vulnerability exposure.