CVE-2026-72871
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Dokploy prior to 0.29.13 contains a vulnerability in the unauthenticated /api/providers/github/setup route that trusts gh_init organizationId and userId values from the state parameter and calls createGithub, allowing an attacker to insert a GitHub App provider containing client_secret, webhook_secret, and PEM private key material into another organization.
Risk Assessment
An unauthenticated attacker can inject a malicious GitHub provider into another organization, potentially leading to secret theft and unauthorized access.
Recommendation
Update Dokploy to version 0.29.13 or later, which includes the fix.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts gh_init organizationId and userId values from the state parameter and calls createGithub in packages/server/src/services/github.ts, allowing an attacker to insert a GitHub App provider containing client_secret, webhook_secret, and PEM private key material into another organization. This issue is fixed in version 0.29.13.