CVE-2026-72866
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Dokploy before version 0.29.13 has a vulnerability in the WebSocket handler, where session validation does not authorize access to the requested server. An authenticated user can connect to a terminal on the Dokploy host without the required organization role or server-access check.
Risk Assessment
An unauthorized user can gain an interactive terminal on the Dokploy host, potentially leading to unauthorized system and data access.
Recommendation
Update Dokploy to version 0.29.13 or later, which fixes this issue.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handler in apps/dokploy/server/wss/terminal.ts validates a session but does not authorize access to the requested server. An authenticated user can connect to /terminal?serverId=local, select the special serverId=local branch, and obtain an interactive terminal on the Dokploy host without an organization role or server-access check. This issue is fixed in version 0.29.13.