CyberRota Analysis
AI-GeneratedDokploy versions prior to 0.29.13 are vulnerable due to insufficient authorization in their WebSocket handlers, allowing authenticated users to access interactive shells in any container, including those that can interact with the Docker socket. This critical flaw can lead to full host compromise, enabling attackers to gain root access and breach tenant isolation. Organizations using Dokploy should prioritize upgrading to version 0.29.13 to mitigate this severe security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's WebSocket handlers (in-app terminals and log streamers) authenticate the session but never authorize it. They establish who the user is via validateRequest() and then proceed without consulting the role/permission model that every tRPC procedure enforces. Any authenticated member, can therefore open an interactive shell into any container on the host, including the dokploy container that mounts the Docker socket, and from there obtain root on the host, escaping the application and crossing every tenant boundary. This vulnerability is fixed in 0.29.13.