CyberRota Analysis
AI-GeneratedDokploy versions prior to 0.29.13 expose sensitive GitHub credentials, including githubClientSecret, githubPrivateKey, and githubWebhookSecret, through the application API, allowing users with minimal permissions to access these secrets. This vulnerability could lead to unauthorized access to GitHub accounts and associated resources. Organizations using Dokploy should prioritize upgrading to version 0.29.13 to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by findApplicationById in packages/server/src/services/application.ts without redacting githubClientSecret, githubPrivateKey, or githubWebhookSecret, allowing a user with only service:read permission to retrieve another user’s Git provider secrets even when hasGitProviderAccess is false and unauthorizedProvider is set. This issue is fixed in version 0.29.13.