CVE-2026-72876CWE-639CWE-78CWE-862broken-access-controlcommand-injection

CVE-2026-72876

Critical · published August 11, 2026

CVSS v3.1
9.9
EPSS
1%
Percentile
52.9
In the wild
Unconfirmed
What it is

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in apps/dokploy/server/api/routers/swarm.ts accept another organization’s serverId without an activeOrganizationId ownership check, and getNodeInfo in packages/server/src/services/docker.ts interpolates nodeId into execAsyncRemote, allowing a caller with server:read permission to execute arbitrary commands as the configured SSH user on another tenant’s server. This issue is fixed in version 0.29.13.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00707 · 52.9th percentile
Weaknesses
CWE-639 · Authorization Bypass Through User-Controlled Key; CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'); CWE-862 · Missing Authorization
Published
2026-08-11T00:17Z
References (5)
https://github.com/Dokploy/dokploy/commit/5563699f71b2058b49eebdfd66c6c3dbd92ede9c · [email protected]https://github.com/Dokploy/dokploy/pull/4858 · [email protected]https://github.com/Dokploy/dokploy/releases/tag/v0.29.13 · [email protected]https://github.com/Dokploy/dokploy/security/advisories/GHSA-jj6h-388v-9rwm · [email protected]https://github.com/Dokploy/dokploy/security/advisories/GHSA-jj6h-388v-9rwm · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 10 AUG 19:00Z
    Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.*
    cvelistv5