CVE-2026-45632: Dokploy: Schedule Authorization Bypass Enables Host/Server Command Execution
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.7 and earlier, the schedule router does not enforce organization/role checks. As a result, any authenticated user can create, update, run, or delete schedules belonging to other organizations if they know the scheduleId/serverId. Schedule types server and dokploy-server write and execute scripts on the host or remote servers, enabling RCE on the Dokploy host or a target server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.26.7 - Compensating control
Restrict access to the schedule router/API endpoints that handle schedule create/update/run/delete so that authenticated users cannot act on schedules belonging to other organizations unless proper organization/role checks are enforced (e.g., enforce org/role authorization at the network/API layer).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45632?
CVE-2026-45632 has a critical severity rating of 9.9.
What does CVE-2026-45632 exploit?
CVE-2026-45632 exploits a schedule authorization bypass in Dokploy, enabling command execution on the host or server.
How do I fix CVE-2026-45632?
To fix CVE-2026-45632, update to Dokploy version 0.26.8 or later, which includes the necessary security patches.
Who is affected by CVE-2026-45632?
Any user of Dokploy version 0.26.7 or earlier is affected by CVE-2026-45632.
What kind of attacks can CVE-2026-45632 lead to?
CVE-2026-45632 can lead to unauthorized command execution and manipulation of schedules across different organizations.