CVE-2026-72873: Dokploy: Cross-tenant Git provider secrets are disclosed to low-privileged service readers via `application.one`
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by findApplicationById in packages/server/src/services/application.ts without redacting githubClientSecret, githubPrivateKey, or githubWebhookSecret, allowing a user with only service:read permission to retrieve another user’s Git provider secrets even when hasGitProviderAccess is false and unauthorizedProvider is set. This issue is fixed in version 0.29.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.29.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72873?
CVE-2026-72873 has a medium severity rating of 6.5.
What systems are affected by CVE-2026-72873?
CVE-2026-72873 affects versions of Dokploy prior to 0.29.13.
How do I fix CVE-2026-72873?
To mitigate CVE-2026-72873, upgrade Dokploy to version 0.29.13 or later.
What type of vulnerability is CVE-2026-72873?
CVE-2026-72873 is classified as an information leakage vulnerability.
What kind of information is disclosed in CVE-2026-72873?
CVE-2026-72873 discloses sensitive Git provider secrets, specifically githubClientSecret and githubPrivateKey.