CVE-2026-86059: Dokploy PaaS Information Disclosure Flaw

CVE-2026-86059 Overview

Dokploy is a free, self-hostable Platform as a Service (PaaS). Versions prior to 0.29.13 expose plaintext Git provider credentials to organization members who lack Git provider access. Protected tRPC procedures github.one, gitlab.one, gitea.one, and bitbucket.one return full provider rows without applying getAccessibleGitProviderIds or an organization check. The application.one route compounds the issue by returning nested provider relations from findApplicationById, leaking GitHub App private keys, OAuth tokens, client secrets, webhook secrets, and Bitbucket app passwords. This information disclosure flaw is tracked as [CWE-200] and is fixed in version 0.29.13.

Critical Impact
An authenticated organization member with only application read access can retrieve plaintext Git provider secrets, then use them to access private repositories or manipulate external CI/CD workflows.

Affected Products

Dokploy versions prior to 0.29.13
Self-hosted Dokploy PaaS deployments with multiple organization members
Dokploy instances integrating GitHub, GitLab, Gitea, or Bitbucket providers

Discovery Timeline

2026-09-22 - CVE CVE-2026-86059 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-86059

Vulnerability Analysis

The vulnerability stems from missing authorization checks in Dokploy's tRPC router layer. The github.one, gitlab.one, gitea.one, and bitbucket.one procedures return complete provider records without validating whether the caller has been assigned that provider. The application.one endpoint aggravates the exposure by eagerly loading nested provider relations through findApplicationById, returning secret columns alongside application metadata.

Any organization member with application read access can call these endpoints and receive plaintext credentials in the response body. The exposed material includes GitHub App private keys, OAuth access and refresh tokens, client secrets, webhook signing secrets, and Bitbucket app passwords. An attacker can then authenticate directly against the upstream Git provider, clone private repositories, push malicious commits, or forge webhook payloads to trigger unauthorized deployments.

Root Cause

The root cause is a broken access control pattern [CWE-200]: the affected procedures rely on organization membership alone and never invoke getAccessibleGitProviderIds or apply a hasGitProviderAccess check before returning provider rows. Query-level column selection also failed to exclude secret fields, so ORM relations returned every column by default.

Attack Vector

Exploitation requires only valid organization member credentials and network access to the Dokploy API. The attacker calls one of the vulnerable .one procedures with a known provider or application identifier and parses secrets directly from the JSON response.

typescript

// Patch: exclude git provider secrets at query level in findApplicationById
// packages/server/src/services/application.ts
			redirects: true,
			security: true,
			ports: true,
-			gitlab: true,
-			github: true,
-			bitbucket: true,
-			gitea: true,
+			gitlab: {
+				columns: { secret: false, accessToken: false, refreshToken: false },
+			},
+			github: {
+				columns: {
+					githubClientSecret: false,
+					githubPrivateKey: false,
+					githubWebhookSecret: false,
+				},
+			},
+			bitbucket: { columns: { appPassword: false, apiToken: false } },
+			gitea: {
+				columns: {
+					clientSecret: false,
+					accessToken: false,
+					refreshToken: false,
+				},
+			},
			server: true,
			previewDeployments: true,
			registry: { columns: { password: false } },
// Source: https://github.com/Dokploy/dokploy/commit/ecbaf6060bf6d00491ee51086e28258979777226

Detection Methods for CVE-2026-86059

Indicators of Compromise

Unexpected calls to github.one, gitlab.one, gitea.one, or bitbucket.one tRPC procedures from members without assigned Git provider access.
High-volume enumeration of application.one requests by a single organization member iterating through application identifiers.
New clones, forks, or webhook registrations at the upstream Git provider originating from IP addresses associated with the Dokploy host or its users.

Detection Strategies

Enable request-body logging on the Dokploy API gateway and alert when responses to the affected procedures contain fields named githubPrivateKey, githubClientSecret, accessToken, refreshToken, or appPassword.
Correlate Dokploy audit logs with GitHub, GitLab, Gitea, and Bitbucket audit events to identify credential reuse from unexpected sources.
Review database access patterns for reads against github, gitlab, gitea, and bitbucket provider tables that are not tied to a deployment operation.

Monitoring Recommendations

Ingest Dokploy application logs and upstream Git provider audit logs into a central data lake for cross-source correlation.
Alert on any successful authentication to GitHub, GitLab, Gitea, or Bitbucket using stored app credentials from IP ranges outside the deployment infrastructure.
Track version metadata for Dokploy instances and flag any host running a release earlier than 0.29.13.

How to Mitigate CVE-2026-86059

Immediate Actions Required

Upgrade all Dokploy instances to version 0.29.13 or later without delay.
Rotate every stored GitHub App private key, OAuth token, client secret, webhook secret, and Bitbucket app password after upgrading.
Audit organization member rosters and remove accounts that do not require access to the Dokploy control plane.
Review upstream Git provider audit logs for unauthorized repository access or webhook changes since the vulnerable version was deployed.

Patch Information

The fix is delivered in Dokploy 0.29.13. Commit ecbaf60 restricts ORM column selection in findApplicationById so provider secrets are excluded at the query level, and the .one procedures were updated to enforce getAccessibleGitProviderIds. Full details are available in the GitHub Security Advisory GHSA-wx75-vxph-2m2f and the GitHub Release v0.29.13.

Workarounds

Restrict Dokploy organization membership to trusted administrators until the patch is applied.
Place the Dokploy API behind an authenticating reverse proxy that limits which members can reach the github, gitlab, gitea, bitbucket, and application routers.
If provider isolation is not required, temporarily remove stored Git provider integrations and rely on manual deployment triggers until the upgrade is complete.

bash

# Upgrade Dokploy to the patched release
docker pull dokploy/dokploy:0.29.13
docker service update --image dokploy/dokploy:0.29.13 dokploy

# Verify running version
curl -s https://<dokploy-host>/api/health | jq '.version'