CVE-2026-72734: Dokploy Auth Bypass Vulnerability

CVE-2026-72734 Overview

Dokploy is a free, self-hostable Platform as a Service (PaaS). CVE-2026-72734 is an authorization flaw affecting Dokploy versions 0.28.7 through 0.29.12. The server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId without verifying that the target server belongs to the caller's organization. An authenticated owner or administrator with server:delete in one organization can delete servers registered to a different organization and receive the associated plaintext SSH private key. The issue is fixed in version 0.29.13 and is tracked as [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact
Cross-tenant server deletion, deployment record loss, and disclosure of plaintext SSH private keys belonging to other organizations.

Affected Products

Dokploy versions 0.28.7 through 0.29.12
apps/dokploy/server/api/routers/server.ts (server.remove tRPC mutation)
Self-hosted Dokploy PaaS deployments with multiple organizations

Discovery Timeline

2026-08-10 - CVE-2026-72734 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72734

Vulnerability Analysis

The vulnerability resides in the server.remove tRPC mutation exposed by the Dokploy API. The mutation accepts a serverId value supplied by the caller and immediately routes it through haveActiveServices, findServerById, removeDeploymentsByServerId, and deleteServer. None of these calls confirms that the target server's organizationId matches ctx.session.activeOrganizationId. An authenticated user with the server:delete permission in any organization can therefore act on servers owned by other tenants.

Because the server record includes the plaintext SSH private key used to manage that host, the API response returns that key to the attacker. The related server.one read endpoint enforces the organization check and denies cross-tenant reads, but server.remove did not, producing an inconsistent authorization surface. Successful abuse deletes deployment history, breaks Dokploy management of the host, and hands the caller credentials sufficient to log in to the underlying server over SSH.

Root Cause

The root cause is a missing organization ownership check on a caller-controlled identifier. server.remove treated any serverId submitted by an authenticated administrator as authorized, so authorization decisions were made without validating that the object belonged to the caller's tenant. This pattern maps to [CWE-639: Authorization Bypass Through User-Controlled Key].

Attack Vector

The attacker must be authenticated and hold owner or administrator privileges with server:delete in at least one organization. The attacker must also have previously observed the target serverId from another organization, for example through a leaked link, shared incident, or prior access. With that identifier, the attacker calls server.remove over the network. The server is deleted, deployment records are purged, and the SSH private key is returned in the response.

typescript

// Patch: enforce organization ownership on server.remove
// Source: https://github.com/Dokploy/dokploy/commit/4aee66b2d1dc2c027749a541e553aa49947075c1
		.input(apiRemoveServer)
		.mutation(async ({ input, ctx }) => {
			try {
+				const currentServer = await findServerById(input.serverId);
+				if (currentServer.organizationId !== ctx.session.activeOrganizationId) {
+					throw new TRPCError({
+						code: "UNAUTHORIZED",
+						message: "You are not authorized to delete this server",
+					});
+				}
+
				const activeServers = await haveActiveServices(input.serverId);

				if (activeServers) {

The patch performs a findServerById lookup first and rejects the request with a tRPC UNAUTHORIZED error whenever organizationId does not match the caller's active organization. See GitHub commit 4aee66b and Pull Request #4874 for the full change.

Detection Methods for CVE-2026-72734

Indicators of Compromise

Unexpected server.remove tRPC calls in Dokploy application logs referencing serverId values that do not belong to the caller's active organization.
Sudden deletion of server registrations or deployment records without a corresponding administrator action ticket.
SSH sessions to managed hosts originating from IP addresses that do not match known operator infrastructure, following a suspicious server.remove event.

Detection Strategies

Correlate authenticated tRPC mutations against the acting session's activeOrganizationId and alert on mismatches between the caller's organization and the affected serverId.
Alert on any server.remove invocation followed by SSH authentication to the removed host from a new source address within a short time window.
Baseline the frequency of server deletions per organization and flag statistical anomalies.

Monitoring Recommendations

Enable verbose audit logging for Dokploy administrative mutations, including server.remove, removeDeploymentsByServerId, and deleteServer.
Ship Dokploy application and audit logs to a centralized log store and retain them long enough to reconstruct multi-step cross-tenant activity.
Monitor SSH authorized_keys usage on managed hosts and rotate any key material that may have been exposed prior to patching.

How to Mitigate CVE-2026-72734

Immediate Actions Required

Upgrade all Dokploy instances to version 0.29.13 or later without delay.
Rotate every SSH private key stored in Dokploy that could have been returned to another organization through the vulnerable endpoint.
Review audit logs for prior server.remove calls where the target serverId did not belong to the caller's organization, and treat matches as confirmed compromise.
Restrict who holds the server:delete permission and revoke it from accounts that do not require it.

Patch Information

The fix is included in Dokploy v0.29.13. See the GitHub Release v0.29.13, the GitHub Security Advisory GHSA-3rpx-c3j9-q99x, and the upstream commit 4aee66b. The patch adds an explicit organizationId equality check against ctx.session.activeOrganizationId inside the server.remove mutation and returns a tRPC UNAUTHORIZED error on mismatch.

Workarounds

Temporarily restrict Dokploy administrative API access to trusted network ranges until the upgrade to 0.29.13 is complete.
Reduce the number of organizations hosted on a single Dokploy instance, or isolate high-value tenants onto dedicated deployments.
Remove the server:delete role assignment from any account that does not have an operational need for it.

bash

# Upgrade Dokploy self-hosted deployment to the patched release
docker pull dokploy/dokploy:0.29.13
docker stop dokploy && docker rm dokploy
# Recreate the container using your existing environment variables and volumes,
# pinning the image tag to 0.29.13 or later.

# After upgrade, rotate any SSH keys managed by Dokploy that may have been exposed.