CVE-2026-127212
Deferred Deferred - Pending Action

Missing Ownership Check in Dokploy Exposes Container Metrics

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Dokploy before 0.31.1 contains a missing ownership check vulnerability in the readAppMonitoring tRPC procedure that allows authenticated attackers to access container metrics belonging to other organizations by supplying an arbitrary appName. Attackers can query getApplicationStats with any application name, including the fixed "dokploy" control-plane service name, to read CPU, memory, network I/O, and block I/O metrics for containers they do not own on self-hosted multi-tenant instances.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-127212
EUVD
EUVD-2026-124738

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Dokploy dokploy From 0 (inc) to 0.31.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Dokploy before version 0.31.1 has a missing ownership check in the readAppMonitoring tRPC procedure. This allows authenticated attackers to access container metrics of other organizations by providing an arbitrary appName. Attackers can query getApplicationStats with any application name, including the fixed 'dokploy' control-plane service name, to read CPU, memory, network I/O, and block I/O metrics for containers they do not own on self-hosted multi-tenant instances.

Detection Guidance

Check Dokploy versions prior to 0.31.1 by running: dokploy version. If vulnerable, test access by querying getApplicationStats with arbitrary appName values to see if metrics for other organizations are exposed. Monitor logs for unauthorized access attempts to monitoring endpoints.

Impact Analysis

This vulnerability allows attackers to view sensitive container metrics of other organizations or the control-plane service. This could lead to information disclosure, resource usage analysis, or potential lateral movement within the system. The impact is limited to self-hosted multi-tenant instances and requires authentication.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection principles or HIPAA's security requirements for protected health information. It may result in non-compliance due to unauthorized data exposure and insufficient access controls.

Mitigation Strategies

Upgrade Dokploy to version 0.31.1 or later immediately. Ensure no unauthorized access has occurred by reviewing monitoring logs for suspicious queries. Restrict network access to Dokploy instances if multi-tenant.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-127212. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...