CVE-2026-72864 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the local branch of /docker-container-terminal in apps/dokploy/server/wss/docker-container-terminal.ts authenticates with validateRequest but does not authorize the attacker-controlled containerId against the caller's role, organization, or service access before passing it to `docker exec`, allowing any authenticated member to obtain a root shell in arbitrary containers on a self-hosted instance. This issue is fixed in version 0.29.13.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability described represents a critical authorization bypass flaw in Dokploy versions prior to 0.29.13 that fundamentally undermines the security boundaries of self-hosted instances. This issue exists within the docker-container-terminal endpoint located at apps/dokploy/server/wss/docker-container-terminal.ts where the system performs initial authentication through validateRequest but fails to implement proper authorization checks before executing privileged operations. The absence of container access controls creates a scenario where any authenticated user can escalate privileges and gain root shell access to arbitrary containers running on the same host, effectively eliminating the isolation that containerization is designed to provide.
The technical implementation flaw stems from the lack of proper input validation and authorization enforcement within the websocket terminal handler. When an authenticated user establishes a connection to the docker-container-terminal endpoint, the system only verifies that the user has valid credentials but does not confirm whether the requested containerId corresponds to resources the user should be able to access. This oversight allows attackers to manipulate the containerId parameter to target containers belonging to other users or services within the same self-hosted environment. The flaw directly enables privilege escalation through the docker exec command execution, which operates with elevated privileges and can provide full control over the targeted container processes.
The operational impact of this vulnerability is severe for organizations relying on self-hosted Dokploy instances as it completely compromises container isolation and user separation. An authenticated attacker can execute arbitrary commands within any container accessible to the instance, potentially leading to data exfiltration, service disruption, or further lateral movement within the infrastructure. The vulnerability affects all users with valid authentication credentials, making it particularly dangerous in environments where multiple teams or clients share the same Dokploy instance. This issue essentially allows for complete compromise of the underlying container runtime environment and can result in unauthorized access to sensitive applications and data stored within other containers.
From a cybersecurity perspective, this vulnerability maps directly to CWE-285 (Improper Authorization) and aligns with ATT&CK techniques focusing on privilege escalation and lateral movement. The flaw demonstrates a classic case of insufficient authorization controls where authentication is properly implemented but authorization boundaries are completely missing. Organizations should immediately update to version 0.29.13 to address this vulnerability, as the fix likely implements proper container access controls that verify user permissions against container ownership or organizational boundaries before executing docker exec operations. Additionally, administrators should review existing access controls and consider implementing network segmentation to limit exposure while awaiting updates, particularly in multi-tenant environments where user isolation is critical for maintaining security posture.