Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts gh_init organizationId and userId values from the state parameter and calls createGithub in packages/server/src/services/github.ts, allowing an attacker to insert a GitHub App provider containing client_secret, webhook_secret, and PEM private key material into another organization. This issue is fixed in version 0.29.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-10T19:17:36.033Z",
  "pubdate": "2026-08-10T19:17:36.033Z",
  "executiveSummary": "Dokploy versions prior to 0.29.13 contain an improper input validation vulnerability within the unauthenticated GitHub provider setup route. This flaw allows an unauthenticated remote attacker to supply arbitrary organizationId and userId values via the state parameter during the OAuth configuration flow. By manipulating these parameters, an attacker can coerce the server-side logic into associating and injecting malicious or attacker-controlled GitHub App provider credentials—including client_secret, webhook_secret, and PEM private key material—into arbitrary organizations within the platform. The resulting impact compromises the integrity and confidentiality of target organization configurations, potentially enabling unauthorized resource access or administrative manipulation across tenant boundaries. Exploitation requires network access to the target Dokploy instance and interaction with the exposed API endpoint without requiring prior authentication or valid session credentials. Remediation requires upgrading Dokploy to version 0.29.13 or later, where state parameter validation and trust boundaries are properly enforced.",
  "technicalDetails": "The vulnerability resides in the unauthenticated API endpoint located at apps/dokploy/pages/api/providers/github/setup.ts within Dokploy prior to version 0.29.13. The root cause of the flaw stems from insecure deserialization or direct trust of parameters passed within the OAuth state query parameter. Specifically, the route extracts the gh_init organizationId and userId values directly from the state parameter without validating whether the incoming request legitimately owns or has authorization to modify the specified target organization context. Upon extracting these unverified identifiers, the application subsequently invokes the createGithub function defined in packages/server/src/services/github.ts. This function processes the payload and persists the provider configuration into the database. The attack flow begins when an unauthenticated adversary crafts a malicious HTTP request targeting the /api/providers/github/setup route. The attacker embeds arbitrary, high-value organizationId and userId targets inside the state parameter, alongside malicious or arbitrary GitHub App provider credentials, such as client_secret, webhook_secret, and sensitive PEM-formatted private key material. Because the vulnerable endpoint is exposed over the network without authentication constraints, the Dokploy backend trusts the supplied state values implicitly. It executes the persistence logic, resulting in the unauthorized insertion of GitHub App provider details into a victim organization's account scope. The post-exploitation impact includes unauthorized provider takeover, potential repository access, and cross-tenant configuration tampering, heavily degrading the multi-tenant isolation guarantees of the PaaS platform."
}