CVE-2026-72876

CriticalCVSS 9.9

Published: 10/08/2026(UTC)Translated: 11/08/2026(UTC)NVD NIST

Summary

In Dokploy prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in swarm.ts accept another organization’s serverId without an activeOrganizationId ownership check, and getNodeInfo in docker.ts interpolates nodeId into execAsyncRemote, allowing a caller with server:read permission to execute arbitrary commands as the configured SSH user on another tenant’s server. This issue is fixed in version 0.29.13.

Risk Assessment

A user with server read permission can execute arbitrary commands on another organization's server, leading to tenant isolation breach.

Recommendation

Update Dokploy to version 0.29.13 or later to fix the vulnerability.

Original NVD description (English source)

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in apps/dokploy/server/api/routers/swarm.ts accept another organization’s serverId without an activeOrganizationId ownership check, and getNodeInfo in packages/server/src/services/docker.ts interpolates nodeId into execAsyncRemote, allowing a caller with server:read permission to execute arbitrary commands as the configured SSH user on another tenant’s server. This issue is fixed in version 0.29.13.