Dokploy up to 0.29.12 WebSocket handlers validateRequest improper authorization

Summaryinfo

A vulnerability was found in Dokploy up to 0.29.12. It has been declared as very critical. Affected is the function validateRequest of the component WebSocket handlers. Such manipulation leads to improper authorization. This vulnerability is listed as CVE-2026-72863. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Dokploy up to 0.29.12. Affected by this issue is the function validateRequest of the component WebSocket handlers. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's WebSocket handlers (in-app terminals and log streamers) authenticate the session but never authorize it. They establish who the user is via validateRequest() and then proceed without consulting the role/permission model that every tRPC procedure enforces. Any authenticated member, can therefore open an interactive shell into any container on the host, including the dokploy container that mounts the Docker socket, and from there obtain root on the host, escaping the application and crossing every tenant boundary. This vulnerability is fixed in 0.29.13.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-72863 since 08/10/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/10/2026). The MITRE ATT&CK project declares the attack technique as T1548.002.

Upgrading to version 0.29.13 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-55703). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Dokploy

Version

• 0.29.0
• 0.29.1
• 0.29.2
• 0.29.3
• 0.29.4
• 0.29.5
• 0.29.6
• 0.29.7
• 0.29.8
• 0.29.9
• 0.29.10
• 0.29.11
• 0.29.12

Website

• Product: https://github.com/Dokploy/dokploy/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion