CVE-2026-72876

Received Received - Intake

SSH Command Injection in Dokploy

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in apps/dokploy/server/api/routers/swarm.ts accept another organization’s serverId without an activeOrganizationId ownership check, and getNodeInfo in packages/server/src/services/docker.ts interpolates nodeId into execAsyncRemote, allowing a caller with server:read permission to execute arbitrary commands as the configured SSH user on another tenant’s server. This issue is fixed in version 0.29.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-72876

EUVD

EUVD-2026-55741

Affected Vendors & Products

Vendor	Product	Version / Range
dokploy	dokploy	to 0.29.13 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Dokploy before 0.29.13 has an authorization flaw in its swarm API endpoints. Functions like swarm.getNodes and swarm.getNodeInfo accept a serverId from another organization without verifying ownership via activeOrganizationId. This allows a user with server:read permission to access or manipulate nodes belonging to different tenants. Additionally, swarm.getNodeInfo can inject a nodeId into a command executed via SSH on another tenant's server, enabling arbitrary command execution as the configured SSH user.

Detection Guidance

The vulnerability affects Dokploy versions prior to 0.29.13. Check your Dokploy version with: dokploy --version. If the version is below 0.29.13, the system is vulnerable. Monitor logs for unauthorized SSH command execution attempts or unexpected remote commands.

Impact Analysis

If you use Dokploy versions before 0.29.13, an attacker with server:read permission could access or control servers belonging to other organizations in your Dokploy instance. This could lead to data breaches, unauthorized modifications, or disruption of services hosted on those servers.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, non-compliance with access control and audit logging requirements, and potential legal penalties or loss of certification.

Mitigation Strategies

Upgrade Dokploy to version 0.29.13 or later immediately. Review and restrict server:read permissions to trusted users. Audit logs for suspicious activity and revoke unauthorized access. Ensure SSH user configurations are secure and limited.

Hi! I’m here to help you understand CVE-2026-72876. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70