Executive Summary

CVE-2026-45632 is a critical vulnerability in Dokploy versions up to 0.26.7 where the schedule router does not enforce organization or role-based access controls.

This flaw allows any authenticated user who knows a scheduleId or serverId to create, update, run, or delete schedules belonging to other organizations.

The schedules of type "server" and "dokploy-server" write and execute scripts on the host or remote servers, enabling remote code execution (RCE).

An attacker can exploit this by creating a malicious schedule with a script payload and executing it immediately, gaining full control over the Dokploy host or remote servers.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized remote code execution on the Dokploy host or connected remote servers.

An attacker can gain full control over affected systems, compromising confidentiality, integrity, and availability of data and services.

Because the vulnerability allows bypassing authorization checks, attackers can manipulate schedules across organizations, potentially disrupting operations or deploying malicious code.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying unauthorized schedule creation, updates, execution, or deletion by authenticated users across organizations. Since the vulnerability allows any authenticated user to manipulate schedules if they know scheduleId or serverId, monitoring API calls related to schedule management can help detect exploitation attempts.

Specifically, you can look for unusual API requests that create or run schedules with the "server" or "dokploy-server" types, as these execute scripts on hosts or remote servers.

While no explicit commands are provided in the resources, general detection steps include:

• Monitor API logs for schedule creation, update, run, or delete actions by users outside their organization.
• Check for execution of scripts or commands on the Dokploy host or remote servers triggered by schedules.
• Audit authentication logs for suspicious activity involving scheduleId or serverId usage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include enforcing organization and role-based authorization checks on the schedule router and service layer to prevent unauthorized access.

Restrict the ability to create or run schedules of type "server" and "dokploy-server" to privileged users only.

Validate scheduleId and serverId against the active organization to ensure users cannot access schedules outside their organization.

Additionally, review and update Dokploy to a version later than v0.26.7 where these fixes are applied.

Useful 0 Not Useful 0

Compliance Impact

CVE-2026-45632 allows unauthorized users to bypass authorization checks and execute arbitrary commands on the host or remote servers, leading to full control over sensitive systems.

This critical security flaw impacts confidentiality, integrity, and availability of data and systems, which are core principles in standards such as GDPR and HIPAA.

Failure to enforce proper access controls and privilege management can result in unauthorized data access or manipulation, potentially causing non-compliance with regulations that mandate strict data protection and access controls.

Therefore, organizations using affected versions of Dokploy may face increased risk of regulatory violations due to this vulnerability.

Useful 0 Not Useful 0