CVE-2026-72871 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts gh_init organizationId and userId values from the state parameter and calls createGithub in packages/server/src/services/github.ts, allowing an attacker to insert a GitHub App provider containing client_secret, webhook_secret, and PEM private key material into another organization. This issue is fixed in version 0.29.13.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability in Dokploy affects versions prior to 02913 and resides within the unauthenticated API endpoint /api/providers/github/setup which handles GitHub App provider configuration. This endpoint processes state parameters containing organizationId and userId values without proper validation or authentication checks, creating a critical authorization bypass opportunity. The flaw allows malicious actors to manipulate these parameters and inject GitHub App credentials into arbitrary organizations through the createGithub service function in packages/server/src/services/github.ts.
The technical exploitation involves crafting a malicious state parameter that contains forged organizationId and userId values, which are then directly passed to the backend service without proper sanitization or verification. This creates a path where an attacker can insert complete GitHub App provider configurations including sensitive client secrets, webhook secrets, and PEM private key material into any target organization. The vulnerability stems from inadequate input validation and improper access control enforcement at the API boundary level.
This issue enables severe operational impact including unauthorized access to third-party organization resources, potential data exfiltration through webhook callbacks, and compromised security posture for affected organizations. Attackers can gain persistent access to repositories, automate malicious actions, and potentially escalate privileges within target environments. The vulnerability affects the core PaaS functionality by allowing unauthorized credential injection into the platform's GitHub integration system, undermining the trust model of the service.
The root cause aligns with CWE-285 (Improper Authorization) and CWE-20 (Improper Input Validation) categories, representing a classic authorization bypass through parameter manipulation. From an ATT&CK framework perspective, this maps to T1566 (Phishing) and T1078 (Valid Accounts) where the attacker leverages manipulated parameters to gain unauthorized access. The vulnerability also relates to T1528 (Steal Application Access Token) when considering the exposure of sensitive credentials.
Mitigation strategies include implementing proper authentication checks for the API endpoint, validating all input parameters including organizationId and userId against authorized scopes, and enforcing strict access control policies. Organizations should upgrade to version 0.29.13 or later where the vulnerability has been addressed through proper parameter validation and authorization enforcement. Additionally, monitoring for unusual GitHub App configuration activities and implementing rate limiting on API endpoints can help detect exploitation attempts while maintaining operational security posture.