CVE-2026-72873: Dokploy Information Disclosure Flaw

CVE-2026-72873 Overview

CVE-2026-72873 is an information disclosure vulnerability in Dokploy, a free, self-hostable Platform as a Service (PaaS). Versions prior to 0.29.13 return Git provider relations without redacting sensitive fields in the application.one API response. A user holding only the service:read permission can retrieve another user's githubClientSecret, githubPrivateKey, and githubWebhookSecret values. The exposure occurs even when hasGitProviderAccess is false and unauthorizedProvider is set. The issue is tracked as [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Authenticated low-privilege users can harvest OAuth tokens, app private keys, and webhook secrets belonging to other tenants, enabling downstream compromise of connected Git repositories.

Affected Products

Dokploy versions prior to 0.29.13
apps/dokploy/server/api/routers/application.ts router endpoint application.one
packages/server/src/services/application.ts service function findApplicationById

Discovery Timeline

2026-08-10 - CVE-2026-72873 published to NVD
2026-08-12 - Last updated in NVD database
Fixed in - Dokploy release v0.29.13

Technical Details for CVE-2026-72873

Vulnerability Analysis

The flaw resides in how Dokploy returns application records from the tRPC application.one endpoint. The underlying findApplicationById function eagerly loads provider relations for github, gitlab, gitea, and bitbucket because the server needs those credentials to clone repositories. The API layer serializes the loaded record directly to the client without stripping the secret columns.

Any authenticated user with the service:read role scope can request an arbitrary application ID. The authorization layer sets hasGitProviderAccess to false and marks unauthorizedProvider, but the response payload still contains the raw provider object. The client receives OAuth client secrets, GitHub App private keys, and webhook signing secrets.

Root Cause

The server treated the presence of unauthorizedProvider as a UI hint rather than a data filter. No serialization boundary existed between server-side clone operations and the client response. Secret fields were persisted on the same object graph consumed by the browser.

Attack Vector

An attacker authenticates to Dokploy with any account holding service:read. The attacker calls application.one with the target application identifier. The response body includes the provider relation and its secret fields in plaintext.

typescript

// Patch: apps/dokploy/server/api/routers/application.ts
	mechanizeDockerContainer,
	readConfig,
	readRemoteConfig,
+	redactApplicationGitSecrets,
	removeDeployments,
	removeDirectoryCode,
	removeMonitoringDirectory,

typescript

// Patch: packages/server/src/services/application.ts
	return application;
};

+/**
+ * Blanks the git-provider secret columns nested inside an application before it
+ * is returned to a client. `findApplicationById` eagerly loads the github /
+ * gitlab / gitea / bitbucket relations (needed server-side to clone), but their
+ * OAuth tokens, app private key and webhook secret must never reach the browser:
+ * no client feature reads them, and `application.one` exposed them to any member
+ * with `service:read` even without git-provider access.
+ */
+export const redactApplicationGitSecrets = <
+	T extends {
+		github?: Record<string, unknown> | null;
+		gitlab?: Record<string, unknown> | null;
+		gitea?: Record<string, unknown> | null;
+		bitbucket?: Record<string, unknown> | null;
+	},
+>(
+	application: T,
+): T => {
+	const blank = (
+		provider: Record<string, unknown> | null | undefined,
+		fields: readonly string[],
+	) => {
+		if (!provider) return provider;
+		const redacted = { ...provider };
+		for (const field of fields) {
+			if (field in redacted) redacted[field] = "";
+		}

Source: Dokploy commit 68ea9f7

Detection Methods for CVE-2026-72873

Indicators of Compromise

Unexpected outbound traffic from Dokploy hosts to api.github.com, gitlab.com, or bitbucket.org using tokens tied to another tenant.
Unauthorized commits, pushes, or webhook events signed with a leaked githubWebhookSecret.
New OAuth application installations or repository access grants that do not correlate with legitimate admin activity.

Detection Strategies

Audit Dokploy application-layer logs for application.one tRPC calls made by accounts with only service:read scope against applications they do not own.
Correlate Git provider audit logs (GitHub, GitLab, Gitea, Bitbucket) with Dokploy user sessions to spot token reuse from unusual IPs.
Review database access patterns for bulk enumeration of application IDs by non-admin users.

Monitoring Recommendations

Enable GitHub webhook delivery logging and alert on signature verification failures that could indicate a rotated secret leak.
Track Dokploy user role assignments and flag accounts limited to service:read that generate high volumes of application.one queries.
Monitor for creation of personal access tokens or deploy keys on Git providers immediately following Dokploy API activity.

How to Mitigate CVE-2026-72873

Immediate Actions Required

Upgrade Dokploy to version 0.29.13 or later, which applies redactApplicationGitSecrets to the application.one response.
Rotate all githubClientSecret, githubPrivateKey, githubWebhookSecret, and equivalent GitLab, Gitea, and Bitbucket credentials configured in Dokploy.
Review the roster of accounts holding service:read and remove any that no longer require access.

Patch Information

The fix is delivered in Dokploy v0.29.13 via pull request #4859 and commit 68ea9f7. The patch introduces a redactApplicationGitSecrets helper that blanks secret columns before serialization. See the GHSA-hg9j-j5mc-phf5 advisory for full context.

Workarounds

Restrict Dokploy access to trusted administrators only until the upgrade to 0.29.13 completes.
Disable or revoke service:read role assignments on any multi-tenant Dokploy deployment where full trust between users is not established.
Place Dokploy behind a network boundary that limits API access to known operator IP ranges.

bash

# Upgrade Dokploy to the patched release
docker pull dokploy/dokploy:0.29.13
docker stop dokploy && docker rm dokploy
# Re-run your dokploy container using the 0.29.13 image tag
# Then rotate all Git provider secrets from the Dokploy UI