CyberRota Analysis
AI-GeneratedDokploy versions prior to 0.29.13 are vulnerable due to improper ownership checks in several API endpoints, allowing unauthorized users to execute arbitrary commands on another tenant's server with server:read permissions. This critical vulnerability could lead to severe security breaches, including unauthorized access and command execution on affected Docker environments. Organizations utilizing Dokploy should prioritize upgrading to version 0.29.13 to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in apps/dokploy/server/api/routers/swarm.ts accept another organization’s serverId without an activeOrganizationId ownership check, and getNodeInfo in packages/server/src/services/docker.ts interpolates nodeId into execAsyncRemote, allowing a caller with server:read permission to execute arbitrary commands as the configured SSH user on another tenant’s server. This issue is fixed in version 0.29.13.