CVE-2026-72871: Dokploy: Unauthenticated Git Provider Injection via GitHub OAuth Callback
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts ghinit organizationId and userId values from the state parameter and calls createGithub in packages/server/src/services/github.ts, allowing an attacker to insert a GitHub App provider containing clientsecret, webhooksecret, and PEM private key material into another organization. This issue is fixed in version 0.29.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.29.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72871?
CVE-2026-72871 has a severity rating of high with a score of 7.5.
How do I fix CVE-2026-72871?
To resolve CVE-2026-72871, upgrade Dokploy to version 0.29.13 or later.
What does CVE-2026-72871 exploit?
CVE-2026-72871 exploits the unauthenticated Git Provider Injection via the GitHub OAuth callback.
What is the impact of CVE-2026-72871?
The impact of CVE-2026-72871 is that it allows an attacker to inject unauthorized Git provider configurations.
Which software is affected by CVE-2026-72871?
CVE-2026-72871 affects Dokploy, specifically versions prior to 0.29.13.