CVE-2026-72863: Dokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker host
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's WebSocket handlers (in-app terminals and log streamers) authenticate the session but never authorize it. They establish who the user is via validateRequest() and then proceed without consulting the role/permission model that every tRPC procedure enforces. Any authenticated member, can therefore open an interactive shell into any container on the host, including the dokploy container that mounts the Docker socket, and from there obtain root on the host, escaping the application and crossing every tenant boundary. This vulnerability is fixed in 0.29.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.29.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72863?
The severity of CVE-2026-72863 is rated as critical with a score of 9.9.
How do I fix CVE-2026-72863?
To fix CVE-2026-72863, upgrade Dokploy to version 0.29.13 or later.
What impact does CVE-2026-72863 have on my system?
CVE-2026-72863 allows low-privilege users to gain root access on the Docker host due to missing authorization in WebSocket handlers.
Which version of Dokploy is affected by CVE-2026-72863?
Versions of Dokploy prior to 0.29.13 are affected by CVE-2026-72863.
What components of Dokploy are vulnerable in CVE-2026-72863?
The vulnerable components in CVE-2026-72863 are the WebSocket handlers used for in-app terminals and log streamers.