Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handlers in apps/dokploy/server/wss/terminal.ts, apps/dokploy/server/wss/docker-container-terminal.ts, apps/dokploy/server/wss/docker-container-logs.ts, and apps/dokploy/server/wss/docker-stats.ts validate organization membership but do not enforce checkServiceAccess, accessedServerIds, or accessedServices, allowing an authenticated organization member to obtain root terminal access and read logs or statistics for restricted servers and services. This issue is fixed in version 0.29.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-10T20:17:35.003Z",
  "pubdate": "2026-08-10T20:17:35.003Z",
  "executiveSummary": "An authorization bypass vulnerability exists within the WebSocket handlers of Dokploy prior to version 0.29.13, affecting several core terminal, logging, and statistics components. The root cause stems from insufficient access control checks, specifically the omission of checkServiceAccess, accessedServerIds, and accessedServices validations. While the application properly validates general organization membership, it fails to verify whether an authenticated user possesses explicit authorization to interact with specific servers and services. Consequently, an authenticated organization member with standard privileges can exploit this flaw to execute arbitrary commands, obtain root terminal access, and read sensitive logs or performance statistics for restricted servers and services that should be outside their administrative scope. This introduces severe risk implications, including lateral movement, unauthorized data disclosure, and complete administrative compromise of arbitrary managed containers and infrastructure within the self-hosted PaaS environment. Successful exploitation requires network access to the WebSocket interface and a valid low-privileged user account within any organization on the platform, bypassing intended multi-tenancy and role-based access control boundaries.",
  "technicalDetails": "The vulnerability resides in multiple WebSocket handler files within the Dokploy codebase, specifically apps/dokploy/server/wss/terminal.ts, apps/dokploy/server/wss/docker-container-terminal.ts, apps/dokploy/server/wss/docker-container-logs.ts, and apps/dokploy/server/wss/docker-stats.ts. These endpoints are responsible for facilitating interactive container terminals, streaming container stdout and stderr logs, and broadcasting real-time Docker resource utilization statistics.\nThe underlying technical flaw is an authorization bypass caused by incomplete context validation during WebSocket handshake and message processing. Although the application correctly verifies that an incoming connection originates from an authenticated user belonging to an organization, the specific handlers fail to invoke critical security functions such as checkServiceAccess or validate parameters against accessedServerIds and accessedServices. These missing validation routines are designed to restrict a user's operational scope strictly to the servers and services allocated to their specific role or project membership within the organization.\nThe attack flow proceeds as follows: First, an attacker establishes a standard authenticated session within Dokploy with low-privileged organization membership. Second, the attacker initiates a WebSocket connection targeting one of the vulnerable endpoints, supplying identifiers (such as target server IDs, container IDs, or service UUIDs) corresponding to restricted infrastructure that they are unauthorized to access. Third, because the vulnerable server-side handlers in terminal.ts, docker-container-terminal.ts, docker-container-logs.ts, and docker-stats.ts only check generalized organization membership and omit granular service-level and server-level access checks, the WebSocket connection is successfully established. Fourth, the attacker interacts directly with the stream or terminal interface, gaining the ability to execute commands with root privileges via the container terminals or exfiltrate sensitive operational data through docker-container-logs.ts and docker-stats.ts.\nThe network exposure involves the core application server listening ports utilized by Dokploy. The required authentication level is authenticated user, and the required privilege level is standard organization member. The post-exploitation impact includes full system visibility, container escape potential, unauthorized administrative control over isolated tenants or projects, and severe confidentiality, integrity, and availability breaches across all managed Docker nodes and services."
}