Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handler in apps/dokploy/server/wss/terminal.ts validates a session but does not authorize access to the requested server. An authenticated user can connect to /terminal?serverId=local, select the special serverId=local branch, and obtain an interactive terminal on the Dokploy host without an organization role or server-access check. This issue is fixed in version 0.29.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-10T19:17:35.303Z",
  "pubdate": "2026-08-10T19:17:35.303Z",
  "executiveSummary": "An authorization bypass vulnerability exists within the WebSocket handler of Dokploy prior to version 0.29.13. The vulnerability stems from insufficient access control checks when handling terminal connection requests.\nWhile the application properly validates the user session during the initial connection handshake, it fails to verify whether the authenticated user possesses the necessary authorization or organization role to access the requested server.\nAn authenticated attacker can exploit this flaw by connecting to the /terminal endpoint and supplying a specialized parameter value, specifically selecting the local branch via serverId=local.\nSuccessful exploitation allows a low-privileged or unauthorized user to bypass standard role-based access controls and organization boundaries, obtaining an interactive terminal session directly on the underlying Dokploy host.\nThis introduces severe security risks, including potential remote code execution, full host compromise, and unauthorized administrative control over the affected self-hostable Platform as a Service (PaaS) infrastructure.\nMitigation requires upgrading the Dokploy installation to version 0.29.13 or later, where proper authorization logic has been implemented within the WebSocket handling mechanisms.",
  "technicalDetails": "The vulnerability resides in the WebSocket handling component located at apps/dokploy/server/wss/terminal.ts within the Dokploy codebase.\nThe root cause of the issue is a missing authorization validation step following a successful session validation check.\nWhen a client initiates a WebSocket connection to the /terminal endpoint, the server processes the incoming parameters, specifically looking for the serverId query parameter.\nPrior to version 0.29.13, the application verifies that a session is active and valid, but it omits subsequent checks to ensure that the user attempting the connection has been granted explicit permissions, organization roles, or server-access rights for the targeted environment.\nDuring the attack flow, an authenticated user connects to /terminal?serverId=local, leveraging the lack of server-access validation.\nBy selecting the special serverId=local branch, the backend logic incorrectly assumes authorization and grants access to the host's terminal interface without validating if the user is authorized to interact with the host server.\nThe affected component is exposed over the network via the application's WebSocket server routes, requiring network reachability to the Dokploy instance.\nThe prerequisites for exploitation require the attacker to have a valid authenticated session on the platform, although no specific organization role or high-privilege status is required.\nThe post-exploitation impact includes gaining an interactive shell on the underlying host operating system running the Dokploy instance, enabling the execution of arbitrary system commands, viewing sensitive configuration files, escalating privileges further if misconfigured, and potentially compromising other applications hosted on the same PaaS infrastructure."
}