CVE-2026-72866 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handler in apps/dokploy/server/wss/terminal.ts validates a session but does not authorize access to the requested server. An authenticated user can connect to /terminal?serverId=local, select the special serverId=local branch, and obtain an interactive terminal on the Dokploy host without an organization role or server-access check. This issue is fixed in version 0.29.13.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability identified in Dokploy versions prior to 02913 represents a critical authorization flaw within the WebSocket terminal handler that undermines the platform's security model. This weakness exists in the apps/dokploy/server/wss/terminal.ts file where the system performs session validation but fails to implement proper access control mechanisms for server connections. The flaw allows authenticated users to bypass normal organizational role requirements and server access permissions by manipulating the serverId parameter in terminal connections.
The technical implementation of this vulnerability stems from inadequate input validation and authorization checks within the WebSocket communication layer. When a user establishes a WebSocket connection to the terminal endpoint with serverId=local, the system authenticates the session but does not verify whether the user possesses legitimate access rights to the target server. This creates a path where any authenticated individual can gain interactive terminal access to the Dokploy host itself, effectively providing them with direct control over the underlying infrastructure.
The operational impact of this vulnerability is severe and multifaceted within the context of self-hosted PaaS platforms. An attacker exploiting this flaw could execute arbitrary commands on the host system, potentially leading to complete compromise of the deployment environment. The vulnerability essentially allows privilege escalation from authenticated user status to system administrator level access without proper organizational role validation or server-specific access controls. This undermines the fundamental security boundaries that separate different users and servers within the platform's architecture.
This vulnerability aligns with CWE-285 (Improper Authorization) and represents a classic case of insufficient access control checks in network services. The flaw demonstrates poor adherence to the principle of least privilege, where users should only be granted access to resources commensurate with their defined roles and permissions. From an ATT&CK perspective, this vulnerability maps to T1059 (Command and Scripting Interpreter) and T1078 (Valid Accounts) as it enables command execution through legitimate authenticated sessions while potentially leveraging compromised credentials.
The mitigation strategy involves implementing proper server access validation before establishing terminal connections, ensuring that users must possess appropriate organizational roles and server-specific permissions before gaining access. The fix in version 02913 addresses this by adding mandatory authorization checks that validate both session legitimacy and user entitlements to the target server. Organizations should also implement network-level monitoring to detect unusual terminal connection patterns and consider additional layered security measures such as rate limiting and connection logging. Regular security audits of WebSocket endpoints and input validation mechanisms are essential to prevent similar authorization bypass vulnerabilities in future deployments.