CVE-2026-72886: Dokploy Privilege Escalation Vulnerability

CVE-2026-72886 Overview

CVE-2026-72886 is a privilege escalation vulnerability in Dokploy, a self-hostable Platform as a Service (PaaS). The flaw affects versions 0.29.2 through 0.29.12 and resides in schedule.create and schedule.update handlers within apps/dokploy/server/api/routers/schedule.ts. The routers derive serviceId from applicationId or composeId and enforce the owner/admin host-schedule gate only on the alternative branch. A project member with access to a single application can attach that applicationId to a dokploy-server schedule and invoke schedule.runManually to execute a supplied script as root. Dokploy released a fix in version 0.29.13.

Critical Impact
Authenticated members with limited application access can escalate to root on the Dokploy host and compromise the entire PaaS environment.

Affected Products

Dokploy 0.29.2 through 0.29.12
Fixed in Dokploy 0.29.13
Self-hosted Dokploy PaaS deployments

Discovery Timeline

2026-08-10 - CVE-2026-72886 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72886

Vulnerability Analysis

The vulnerability is an improper privilege management flaw [CWE-269] in Dokploy's schedule router. Dokploy supports several schedule types, including host-level dokploy-server schedules that run scripts as root on the underlying host. Access to host schedules is intended to be restricted to owner and admin roles.

In the affected versions, the router conditionally applies the owner/admin gate only when the schedule is created without an applicationId or composeId. When a request supplies an applicationId the member has access to, the code takes the alternative branch, derives serviceId from that application, and skips the host-schedule authorization check. The schedule is then persisted with a dokploy-server service type but linked to a low-privilege member's application.

Invoking schedule.runManually executes the attacker-supplied scriptPath in the Dokploy host context as root, giving full command execution on the host and any workloads it manages.

Root Cause

The authorization check for host schedules ran in only one of the two conditional branches used to resolve serviceId. The alternative branch, which derives serviceId from an applicationId or composeId, never re-validated whether the caller was permitted to create or modify a dokploy-server (host) schedule.

Attack Vector

An authenticated Dokploy member with permissions to at least one application submits a schedule.create or schedule.update call. The payload references the member's applicationId while setting the schedule type to dokploy-server and specifying a malicious script path. The member then calls schedule.runManually, executing the script as root on the Dokploy host.

typescript

// Patch excerpt from packages/server/src/services/schedule.ts
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
 import type { z } from "zod";
-import { paths } from "../constants";
+import { IS_CLOUD, paths } from "../constants";
 import { db } from "../db";
 import type {
 	createScheduleSchema,
// Source: https://github.com/Dokploy/dokploy/commit/1e3f10bd22c1c28a7b65a2d7ac15a0a5e47599eb

The patch enforces the owner/admin gate on host schedules regardless of whether serviceId originates from applicationId, composeId, or a direct field.

Detection Methods for CVE-2026-72886

Indicators of Compromise

Schedule records with serviceType set to dokploy-server linked to non-admin owned applicationId or composeId values.
Unexpected entries or modifications in the schedule table created by member-role accounts.
Outbound network activity or new processes spawned by the Dokploy server process following a schedule.runManually invocation.
Presence of unfamiliar shell scripts referenced by schedule scriptPath entries on the host filesystem.

Detection Strategies

Audit tRPC access logs for calls to schedule.create, schedule.update, and schedule.runManually originating from non-admin accounts.
Query the Dokploy database for schedules where serviceType = 'dokploy-server' and correlate the linked user role.
Alert on process creation on the Dokploy host where the parent is the Dokploy Node.js process and the child spawns interpreters such as bash, sh, python, or curl.

Monitoring Recommendations

Forward Dokploy application logs and host process telemetry to a centralized log store for retrospective review.
Monitor for privilege boundary anomalies where actions attributed to member-role users result in root-owned file writes or system changes.
Track schedule creation frequency per user and flag first-time host-schedule creations by any account.

How to Mitigate CVE-2026-72886

Immediate Actions Required

Upgrade all Dokploy deployments to version 0.29.13 or later without delay.
Review existing schedules and delete any dokploy-server schedules that were not created by an owner or admin.
Rotate credentials, API tokens, and secrets accessible to the Dokploy host, assuming potential root compromise on unpatched instances.
Audit member role assignments and remove application access that is no longer required.

Patch Information

Dokploy addressed the issue in Dokploy v0.29.13 via pull request #4869 and commit 1e3f10bd. Full details are documented in the GHSA-r89g-h7x9-phr2 security advisory.

Workarounds

Restrict Dokploy console access to trusted administrators until the upgrade is applied.
Temporarily downgrade member accounts or remove their application ownership to prevent them from supplying an applicationId in schedule mutations.
Place the Dokploy management interface behind a VPN or IP allowlist to limit exposure to authenticated attackers.

bash

# Upgrade Dokploy to the patched release
curl -sSL https://dokploy.com/install.sh | sh
# Verify the running version reports 0.29.13 or later
docker exec dokploy dokploy --version