CVE-2026-111331: Dokploy Authorization Bypass Vulnerability

CVE-2026-111331 Overview

CVE-2026-111331 is a cross-organization authorization bypass in Dokploy through version 0.30.8. The flaw resides in the port tRPC router, which fails to verify that a target application belongs to the caller's organization. Authenticated owners or admins of any organization can supply a known portId or applicationId to port.create, port.one, port.update, or port.delete and manipulate other tenants' port mappings. Successful exploitation lets attackers read, modify, delete, or add port entries, disrupting how victim services are published. The weakness is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact

Any authenticated organization owner or admin on a shared Dokploy instance can tamper with port mappings belonging to other tenants, breaking service exposure across organizational boundaries.

Affected Products

• Dokploy through 0.30.8
• Dokploy port tRPC router (apps/dokploy/server/api/routers/port.ts)
• Dokploy permission service (packages/server/src/services/permission.ts)

Discovery Timeline

• 2026-10-15 - CVE-2026-111331 published to the National Vulnerability Database (NVD)
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-111331

Vulnerability Analysis

Dokploy is a self-hosted deployment platform that supports multi-tenant usage through organizations. Each organization owns its own applications, services, and port mappings. The port tRPC router exposes four mutations and queries, port.create, port.one, port.update, and port.delete, which operate on application port records. The router authenticates the caller and confirms they hold an owner or admin role, but it does not confirm that the referenced portId or applicationId belongs to the caller's organization. An attacker who learns or guesses an identifier belonging to another tenant can invoke these endpoints and operate on records outside their scope. Because port mappings control how containers are exposed on the host, tampering changes which service answers on a given port.

Root Cause

The root cause is a missing tenant check in the authorization layer. The permission service validates role membership but never joins the target port or application back to the caller's organization. This is a classic Insecure Direct Object Reference pattern captured by CWE-639, where authorization is granted based on the role presented rather than the ownership of the object being acted upon.

Attack Vector

Exploitation requires network access to the Dokploy API and valid credentials for any organization on the target instance. The attacker calls one of the port router endpoints while supplying a portId or applicationId associated with a victim organization. The server honors the request, returning port data for port.one, altering records for port.update, removing them for port.delete, or inserting new mappings through port.create. See the Dokploy API Router Source Code and the HackMD Dokploy Port Router Analysis for a detailed walkthrough of the vulnerable code paths.

Detection Methods for CVE-2026-111331

Indicators of Compromise

• Unexpected changes to port mappings on applications owned by organizations that did not originate the request.
• tRPC request logs showing calls to port.create, port.update, or port.delete where the authenticated user's organization does not match the application's organization.
• Service exposure changes, such as previously published ports returning connection failures or new ports answering on unexpected services.

Detection Strategies

• Instrument the port router to log the caller's organizationId, the resolved application's organizationId, and the invoked procedure. Alert on mismatches.
• Correlate audit logs for port changes against the identity of the user performing the change and the owning organization of the target application.
• Baseline normal port management activity per tenant and flag deviations in frequency, source IP, or user agent.

Monitoring Recommendations

• Forward Dokploy application logs and reverse proxy logs to a central analytics platform for cross-tenant correlation.
• Monitor Docker and host networking events for port bindings that do not correspond to recent legitimate deployments.
• Review access logs for the Dokploy API endpoint for authenticated sessions issuing high volumes of port.* calls.

How to Mitigate CVE-2026-111331

Immediate Actions Required

• Restrict Dokploy administrative access to trusted networks until a fixed release is deployed.
• Audit organization membership and remove unused or untrusted owner and admin accounts, since valid credentials are required to exploit the flaw.
• Review existing port mappings across all organizations and reconcile any entries that cannot be tied to a legitimate deployment.

Patch Information

At the time of publication, no fixed version is listed in the enriched advisory data. Monitor the Dokploy GitHub Repository and the VulnCheck Security Advisory on Dokploy for an official patched release and upgrade as soon as it becomes available. Any vendor fix should enforce that the target applicationId resolves to the caller's organization before the port router performs read or write operations, as discussed in the Dokploy Permission Service Code.

Workarounds

• Operate single-tenant Dokploy instances where multi-organization isolation is not a security boundary you rely on.
• Place Dokploy behind an authenticating reverse proxy that restricts the API surface to trusted administrators only.
• Rotate credentials and session tokens for any accounts suspected of accessing cross-organization resources.

# Configuration example: restrict Dokploy API exposure at the reverse proxy
# nginx snippet limiting /api/trpc to an admin IP allowlist
location /api/trpc/ {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://127.0.0.1:3000;
}