CVE-2026-72871

Received Received - Intake

Unauthenticated Provider Setup in Dokploy Leading to GitHub App Credential Exposure

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts gh_init organizationId and userId values from the state parameter and calls createGithub in packages/server/src/services/github.ts, allowing an attacker to insert a GitHub App provider containing client_secret, webhook_secret, and PEM private key material into another organization. This issue is fixed in version 0.29.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-72871

EUVD

EUVD-2026-55731

Affected Vendors & Products

Vendor	Product	Version / Range
dokploy	dokploy	0.29.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

Dokploy before version 0.29.13 has an unauthenticated API endpoint /api/providers/github/setup that trusts organizationId and userId values from the state parameter. This allows an attacker to inject a GitHub App provider with sensitive data like client_secret, webhook_secret, and PEM private key into another organization.

Detection Guidance

Check Dokploy version for 0.29.13 or higher. Inspect logs for unauthorized /api/providers/github/setup route access or unexpected GitHub App provider configurations.

Impact Analysis

An attacker could gain unauthorized access to GitHub App configurations, potentially leading to data breaches, unauthorized actions in connected repositories, or misuse of private key material for further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) requirements. Organizations using affected versions may face compliance violations and legal consequences.

Mitigation Strategies

Upgrade Dokploy to version 0.29.13 or later immediately. Review and remove any unauthorized GitHub App providers in your Dokploy instance.

Hi! I’m here to help you understand CVE-2026-72871. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70