CVE-2026-72876 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in apps/dokploy/server/api/routers/swarm.ts accept another organization’s serverId without an activeOrganizationId ownership check, and getNodeInfo in packages/server/src/services/docker.ts interpolates nodeId into execAsyncRemote, allowing a caller with server:read permission to execute arbitrary commands as the configured SSH user on another tenant’s server. This issue is fixed in version 0.29.13.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability affects Dokploy, a self-hostable Platform as a Service solution, where multiple organizations can operate within the same instance. The flaw exists in the swarm API endpoints that handle node and application information retrieval without proper organizational boundary checks. Specifically, functions swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in the server API router lack validation to ensure that the requested serverId belongs to the active organization. This represents a critical authorization bypass vulnerability that allows unauthorized access across tenant boundaries.
The technical exploitation occurs through the getNodeInfo function located in packages/server/src/services/docker.ts where the nodeId parameter is directly interpolated into execAsyncRemote command execution. This interpolation creates a command injection vulnerability when combined with the missing organizational ownership verification. An attacker with server:read permission can manipulate the serverId parameter to target another organization's server, effectively executing arbitrary commands as the configured SSH user on that tenant's infrastructure.
The operational impact of this vulnerability is severe as it enables cross-tenant data exfiltration, command execution, and potential system compromise across different organizations sharing the same Dokploy instance. Attackers can escalate privileges beyond their intended scope to access other tenants' applications, servers, and potentially gain root-level access to the underlying infrastructure. This violates fundamental multi-tenancy security principles and allows for lateral movement between isolated organizational environments.
This vulnerability aligns with CWE-285 (Improper Authorization) and CWE-78 (Improper Neutralization of Special Elements used in an OS Command) categories, representing a classic case of insufficient access control combined with command injection. From an ATT&CK framework perspective, this maps to T1078 (Valid Accounts), T1566 (Phishing), and T1059 (Command and Scripting Interpreter) techniques. The issue demonstrates poor input validation and inadequate privilege separation in multi-tenant environments.
Mitigation strategies should include implementing proper organizational ownership checks before processing any serverId parameters, validating that requested resources belong to the active organization context. The interpolation of user-supplied data into system commands must be eliminated through parameterized queries or strict input sanitization. Additionally, organizations should enforce least privilege access controls and implement proper logging mechanisms to detect unauthorized cross-tenant access attempts. Regular security audits of API endpoints and input validation routines are essential to prevent similar vulnerabilities in multi-tenancy architectures.