CVE-2026-72883: Dokploy Privilege Escalation Vulnerability

CVE-2026-72883 Overview

CVE-2026-72883 is a missing authorization vulnerability [CWE-862] in Dokploy, a self-hostable Platform as a Service (PaaS). Versions prior to 0.29.13 fail to enforce service-level access controls in four WebSocket handlers: apps/dokploy/server/wss/terminal.ts, apps/dokploy/server/wss/docker-container-terminal.ts, apps/dokploy/server/wss/docker-container-logs.ts, and apps/dokploy/server/wss/docker-stats.ts. The handlers validate organization membership but omit checkServiceAccess, accessedServerIds, and accessedServices checks. An authenticated organization member can obtain root terminal access and read logs or statistics for restricted servers and services.

Critical Impact
Any authenticated organization member can escalate privileges to root terminal access on servers and containers they should not be able to reach.

Affected Products

Dokploy versions prior to 0.29.13
Dokploy WebSocket handlers: terminal.ts, docker-container-terminal.ts, docker-container-logs.ts, docker-stats.ts
Self-hosted Dokploy PaaS deployments with multi-user organizations

Discovery Timeline

2026-08-10 - CVE-2026-72883 published to NVD
2026-08-12 - Last updated in NVD database
v0.29.13 - Dokploy releases patched version

Technical Details for CVE-2026-72883

Vulnerability Analysis

Dokploy exposes several WebSocket endpoints that stream interactive terminals, container logs, and Docker statistics from managed servers. Prior to 0.29.13, these handlers checked only that the caller held a valid session tied to an active organization. They did not verify that the caller had permission to reach the specific serverId or serviceId referenced by the request.

Because organization membership does not imply full access to every server or service within that organization, any authenticated member could open a WebSocket to a restricted container and receive a root shell. The same gap exposed container logs and runtime statistics for services outside the caller's access scope, defeating role-based access control at the transport layer.

Root Cause

The root cause is missing authorization [CWE-862] in the WebSocket authorization path. The handlers relied on session + activeOrganizationId as the sole gate. They omitted calls to checkServiceAccess, accessedServerIds, and accessedServices, which are the functions responsible for enforcing per-server and per-service permissions elsewhere in the application.

Attack Vector

An attacker needs valid credentials for any member account in the target Dokploy organization. The attacker connects to one of the vulnerable WebSocket endpoints and supplies a containerId or serverId for a resource outside their granted scope. The handler accepts the request based on organization membership alone and returns a bidirectional stream, granting root shell execution inside the container or access to its logs and stats.

typescript

// Patch: apps/dokploy/server/wss/authorize.ts
// Source: https://github.com/Dokploy/dokploy/commit/68f5afae42fca353dcb3d3bc6219ffe9e168cb91
import { getAccessibleServerIds } from "@dokploy/server";
import {
	findMemberByUserId,
	hasPermission,
} from "@dokploy/server/services/permission";

type WssUser = { id: string } | null | undefined;
type WssSession = { activeOrganizationId?: string | null } | null | undefined;

const buildCtx = (user: { id: string }, activeOrganizationId: string) => ({
	user: { id: user.id },
	session: { activeOrganizationId },
});

// Authorizes docker/container operations opened over a WebSocket (container
// terminal, container logs, container stats). Requires the docker permission
// (owner/admin, or a member explicitly granted canAccessToDocker) and, for a
// remote server, that the server is accessible to the caller. Previously these
// handlers only checked session + organization, so any member could reach a
// root shell / logs of any container.
export const canAccessDockerOverWss = async (
	user: WssUser,
	session: WssSession,
	serverId?: string | null,
): Promise<boolean> => {
	if (!user || !session?.activeOrganizationId) return false;

	const ctx = buildCtx(user, session.activeOrganizationId);
	if (!(await hasPermission(ctx, { docker: ["read"] }))) return false;

The patch introduces canAccessDockerOverWss, which requires the docker: ["read"] permission and verifies server accessibility before opening the stream. The corresponding handler change wires this check into docker-container-logs.ts and the other WebSocket endpoints. See the GitHub Security Advisory GHSA-qf9j-c9p4-r4xp and pull request #4865 for the full fix.

Detection Methods for CVE-2026-72883

Indicators of Compromise

WebSocket connections to /wss/terminal, /wss/docker-container-terminal, /wss/docker-container-logs, or /wss/docker-stats from user accounts that do not have explicit service or server access grants.
Interactive shell processes (bash, sh) spawned inside containers correlated with WebSocket sessions from non-admin members.
Repeated WebSocket requests iterating through different containerId or serverId values from a single session, indicating enumeration.

Detection Strategies

Correlate Dokploy application logs against the organization's permission matrix to flag WebSocket sessions where the user lacks a matching accessedServerIds or accessedServices entry.
Inspect reverse proxy logs (nginx, Traefik, Caddy) for Upgrade: websocket requests to Dokploy terminal endpoints and cross-reference with authenticated user identity.
Monitor container runtime logs for unexpected exec sessions attaching TTYs on services that should be restricted to specific role holders.

Monitoring Recommendations

Enable audit logging for all Dokploy WebSocket handlers and forward events to a centralized log platform for retention and search.
Alert on any successful WebSocket terminal session where the initiating user is not the service owner or an organization admin.
Track container process creation events on Dokploy-managed hosts and baseline expected shell activity per service.

How to Mitigate CVE-2026-72883

Immediate Actions Required

Upgrade Dokploy to version 0.29.13 or later, which enforces canAccessDockerOverWss and equivalent checks on all affected WebSocket handlers.
Audit organization membership and remove any accounts that no longer require access, reducing the pool of principals that could have abused the flaw.
Rotate credentials, SSH keys, and application secrets stored on any server whose containers were reachable by non-privileged members during the exposure window.

Patch Information

The fix is available in Dokploy release v0.29.13. The patch is implemented in commits 1bc76e9 and 68f5afa, which add a shared authorize.ts module and wire canAccessDockerOverWss into each WebSocket handler. Details are documented in GitHub Security Advisory GHSA-qf9j-c9p4-r4xp.

Workarounds

Restrict organization membership to fully trusted users until the upgrade is applied, since the vulnerability requires an authenticated organization member.
Place Dokploy behind a network-level access control that limits which users can reach the WebSocket endpoints, reducing exposure while patching.
Disable Docker terminal, logs, and stats WebSocket endpoints at the reverse proxy if they are not required for daily operations.

bash

# Example: upgrade Dokploy to the patched release
curl -sSL https://dokploy.com/install.sh | sh
# Verify the running version is 0.29.13 or later
docker service inspect dokploy --format '{{.Spec.TaskTemplate.ContainerSpec.Image}}'