CVE-2026-72737: Dokploy Authentication Bypass Vulnerability

CVE-2026-72737 Overview

CVE-2026-72737 is a cross-tenant authorization flaw in Dokploy, a self-hostable Platform as a Service (PaaS). The vulnerability affects versions 0.29.8 and earlier. The backup router in apps/dokploy/server/api/routers/backup.ts accepts a client-controlled destinationId without validating that the referenced destination belongs to the caller's active organization. An authenticated member holding backup permissions in one tenant can reference destinations owned by another tenant, causing that organization's S3 credentials to be materialized on the attacker's host. The flaw is categorized as an Insecure Direct Object Reference [CWE-639].

Critical Impact
Authenticated tenants can exfiltrate another organization's S3 accessKey and secretAccessKey, read cross-tenant backup objects, and poison or redirect backups across organizational boundaries.

Affected Products

Dokploy versions 0.29.8 and earlier
apps/dokploy/server/api/routers/backup.ts backup router endpoints
packages/server/src/utils/backups/utils.ts credential materialization path

Discovery Timeline

2026-08-10 - CVE-2026-72737 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-72737

Vulnerability Analysis

The vulnerability resides in three tRPC procedures exposed by the Dokploy backup router: backup.create, backup.update, and backup.restoreBackupWithLogs. Each procedure accepts a destinationId value supplied by the client. The server dereferences the referenced destination record and uses it directly for backup operations. The procedures never compare destination.organizationId against ctx.session.activeOrganizationId. This missing tenancy check breaks the isolation boundary between organizations that share the same Dokploy instance.

When a backup runs, getS3Credentials in packages/server/src/utils/backups/utils.ts fetches the destination record and materializes the raw S3 accessKey and secretAccessKey on the host executing the backup. Because the destination can belong to any tenant, an attacker's service host receives credentials for another organization's object storage.

Root Cause

The root cause is a missing authorization check on a client-supplied object reference. The router trusts the destinationId argument and looks up the destination without filtering by organizationId. This is a classic Insecure Direct Object Reference pattern where session context is available but not enforced during resource resolution.

Attack Vector

The attacker must hold a valid Dokploy account with backup permissions on any service in any organization. The attacker enumerates or guesses destinationId values belonging to a target organization, then submits backup.create or backup.update referencing that destination. Dokploy materializes the victim tenant's S3 credentials during backup execution. The attacker can also invoke backup.restoreBackupWithLogs to read the victim's backup objects or overwrite them with poisoned content.

Detection Methods for CVE-2026-72737

Indicators of Compromise

Backup jobs referencing destinationId values whose destination organizationId does not match the initiating user's activeOrganizationId.
Unexpected S3 API calls from Dokploy service hosts against buckets belonging to other tenants.
Backup restore operations initiated by users with no historical relationship to the target service.

Detection Strategies

Audit Dokploy database records to correlate backup.destinationId with the organizationId of the owning service and flag mismatches.
Instrument the backup router with logging that records both ctx.session.activeOrganizationId and the resolved destination.organizationId for every invocation.
Review S3 access logs for GetObject, PutObject, and ListBucket operations originating from Dokploy hosts against buckets outside the expected tenant scope.

Monitoring Recommendations

Alert on new backup destinations being attached to services owned by a different organization than the destination.
Monitor for spikes in backup.restoreBackupWithLogs calls, especially those targeting recently modified destinations.
Track outbound egress from Dokploy hosts to unfamiliar S3 endpoints or regions.

How to Mitigate CVE-2026-72737

Immediate Actions Required

Upgrade Dokploy to a version later than 0.29.8 that includes the tenancy check on backup destinations.
Rotate all S3 accessKey and secretAccessKey pairs configured as Dokploy destinations, since credentials may have been materialized on untrusted hosts.
Review backup history for cross-tenant destinationId references and treat matching backup objects as potentially disclosed or poisoned.

Patch Information

Refer to the Dokploy GitHub Security Advisory GHSA-56qv-89fq-3h2q for the fixed release and patch details. The fix enforces that destination.organizationId equals ctx.session.activeOrganizationId before any backup operation proceeds.

Workarounds

Restrict Dokploy instances to a single organization until the patched release is deployed.
Revoke backup permissions from non-administrative members to reduce the population of accounts able to exploit the router.
Scope S3 IAM policies for each destination to the minimum bucket and object prefix required, limiting blast radius if credentials are exposed.

bash

# Configuration example: scope S3 IAM policy per Dokploy destination
# Attach a policy similar to this to the IAM user whose keys back a destination.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:GetObject", "s3:ListBucket"],
      "Resource": [
        "arn:aws:s3:::org-a-dokploy-backups",
        "arn:aws:s3:::org-a-dokploy-backups/*"
      ]
    }
  ]
}