Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by findApplicationById in packages/server/src/services/application.ts without redacting githubClientSecret, githubPrivateKey, or githubWebhookSecret, allowing a user with only service:read permission to retrieve another user’s Git provider secrets even when hasGitProviderAccess is false and unauthorizedProvider is set. This issue is fixed in version 0.29.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-10T20:17:33.350Z",
  "pubdate": "2026-08-10T20:17:33.350Z",
  "executiveSummary": "An information disclosure vulnerability exists in Dokploy prior to version 0.29.13, specifically within the application API router. The vulnerability allows users possessing only service:read permissions to improperly retrieve sensitive Git provider credentials—including githubClientSecret, githubPrivateKey, and githubWebhookSecret—belonging to other users. This exposure occurs even when the requesting user lacks legitimate authorization via hasGitProviderAccess and unauthorizedProvider conditions are triggered. The impact includes the compromise of sensitive cryptographic materials and third-party integration secrets, which can be leveraged to impersonate applications, intercept webhooks, or gain unauthorized access to connected Git repositories. Exploitation requires authenticated access with minimal read-level privileges to the targeted service resource. Remediation requires updating Dokploy to version 0.29.13 or later, where proper credential redaction logic has been implemented within the backend service layer.",
  "technicalDetails": "The vulnerability resides in the application routing and service logic of Dokploy, specifically within application.one located at apps/dokploy/server/api/routers/application.ts and the underlying findApplicationById function in packages/server/src/services/application.ts. The root cause of the issue is the failure to sanitize or redact sensitive properties from database query results before returning them to the client. When an application record is queried, provider relations are loaded and serialized directly into the API response without filtering out critical authentication secrets such as githubClientSecret, githubPrivateKey, and githubWebhookSecret. Although the application logic incorporates authorization checks—such as verifying hasGitProviderAccess and setting unauthorizedProvider flags—these checks fail to restrict the inclusion of the raw credential fields in the payload returned by the server. An attacker authenticated with standard service:read privileges can issue a standard API request to query application details. Despite lacking the necessary access rights to utilize the Git provider configuration, the serialized response inadvertently leaks the plaintext secrets. The attack flow involves identifying a target application ID, issuing a standard read request to the vulnerable application.one endpoint, and parsing the resulting JSON payload to extract the exposed secrets. Post-exploitation impact encompasses unauthorized access to external Git repositories, potential manipulation of CI/CD pipelines via forged webhook events, and the compromise of auxiliary services integrated through the leaked OAuth clients or private keys. The vulnerability affects all Dokploy deployments running versions prior to 0.29.13, exposing systems to authenticated privilege escalation vectors concerning third-party service integrations."
}