CVE-2026-72871: Dokploy Authentication Bypass Vulnerability

CVE-2026-72871 Overview

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to version 0.29.13, the unauthenticated /api/providers/github/setup route trusts organizationId and userId values supplied through the OAuth state parameter. An unauthenticated attacker can call createGithub and insert a GitHub App provider containing client_secret, webhook_secret, and PEM private key material into an arbitrary organization. The flaw is classified as [CWE-306] Missing Authentication for Critical Function and is fixed in Dokploy 0.29.13.

Critical Impact
An unauthenticated network attacker can plant attacker-controlled GitHub App credentials into another tenant's organization, enabling downstream repository access and CI/CD tampering.

Affected Products

Dokploy versions prior to 0.29.13
apps/dokploy/pages/api/providers/github/setup.ts HTTP route
packages/server/src/services/github.tscreateGithub service

Discovery Timeline

2026-08-10 - CVE-2026-72871 published to NVD
2026-08-10 - Last updated in NVD database
Fix released - Dokploy v0.29.13 and GHSA-g9pp-xcf2-ph7x

Technical Details for CVE-2026-72871

Vulnerability Analysis

Dokploy exposes /api/providers/github/setup as the OAuth callback for the GitHub App installation flow. The handler decodes the state parameter, which contains organizationId and userId fields, and passes those values directly to createGithub. The route performs no session validation and does not verify that the calling user belongs to the target organization.

A remote attacker who initiates a gh_init flow can craft the state parameter to reference any organization identifier in the target instance. When GitHub redirects to the callback, Dokploy persists the resulting GitHub App record, including the client_secret, webhook_secret, and PEM private key, under the victim organization. The attacker retains control of the underlying GitHub App and can therefore act on any repository that a victim later connects through that provider.

Root Cause

The handler treats the OAuth state parameter as authoritative input rather than as untrusted user-controlled data. There is no authentication check, no membership check against organizationId, and no binding between the initiating session and the callback. This matches [CWE-306] Missing Authentication for Critical Function.

Attack Vector

Exploitation is fully remote and unauthenticated. The attacker registers a GitHub App, initiates the Dokploy setup flow with a forged state payload targeting a victim organization, and completes the GitHub redirect. No user interaction on the victim side is required.

typescript

// Patch from Dokploy commit 5ae344d - apps/dokploy/pages/api/providers/github/setup.ts
-import { createGithub } from "@dokploy/server";
+import { createGithub, validateRequest } from "@dokploy/server";
 import { db } from "@dokploy/server/db";
+import { hasPermission } from "@dokploy/server/services/permission";
 import { eq } from "drizzle-orm";
 import type { NextApiRequest, NextApiResponse } from "next";
 import { Octokit } from "octokit";

Source: Dokploy commit 5ae344d. The fix adds validateRequest to authenticate the session and hasPermission to authorize the caller against the target organization before invoking createGithub.

Detection Methods for CVE-2026-72871

Indicators of Compromise

Unexpected GitHub App provider records in the Dokploy database whose creation timestamp does not correlate with a legitimate admin session.
Inbound HTTP requests to /api/providers/github/setup originating from IP addresses that never authenticated to /api/auth beforehand.
GitHub App client_id values in the Dokploy configuration that do not match apps registered by the organization's administrators.

Detection Strategies

Correlate every POST or GET to /api/providers/github/setup with an authenticated session cookie in the same request context; flag callback hits without a prior authenticated gh_init initiator.
Alert on rows added to the github provider table where the userId was not active in the audit log within the same time window.
Compare the organizationId on newly created providers against the memberships of the associated userId and alert on mismatches.

Monitoring Recommendations

Ingest Dokploy application logs and reverse-proxy access logs into a central SIEM for query and retention.
Monitor GitHub audit logs for App installations that reference callback URLs pointing at your Dokploy instance from unknown initiators.
Track configuration changes to provider tables and generate alerts on any insert that occurs outside of change-management windows.

How to Mitigate CVE-2026-72871

Immediate Actions Required

Upgrade Dokploy to 0.29.13 or later immediately, as this is the only supported fix.
Audit the github provider table for records created before the upgrade and remove any entries that cannot be tied to a legitimate administrator action.
Rotate client_secret, webhook_secret, and PEM private keys for every GitHub App connected to the Dokploy instance.

Patch Information

The vulnerability is fixed in Dokploy v0.29.13. The patch, tracked in pull request #4870 and commit 5ae344d, adds validateRequest and hasPermission calls to the GitHub setup callback. Refer to GHSA-g9pp-xcf2-ph7x for the vendor advisory.

Workarounds

If patching is not immediately possible, block /api/providers/github/setup at the reverse proxy for all sources except administrator IP ranges.
Temporarily disable the GitHub App provider integration in Dokploy until the upgrade is complete.
Restrict outbound access from Dokploy to the GitHub API so that unauthorized provider records cannot be operationalized.

bash

# Example NGINX block restricting the vulnerable callback to admin CIDR
location = /api/providers/github/setup {
    allow 203.0.113.0/24;   # admin office range
    deny  all;
    proxy_pass http://dokploy_upstream;
}