TI-2026-80148 Aliases CVE-2026-116068 GHSA-w9rf-wg9h-jgwf

Cross-organization authorization bypass in Dokploy application router

MEDIUM 40CWE-639Published 2026-10-25 · Updated 2026-10-26

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Dokploy through 0.30.10 contains an authorization bypass (CWE-639) in its application tRPC router. An owner or admin of any organization can control other tenants' applications by supplying foreign applicationId values. The attacker can overwrite environment variables and build secrets, repoint sources, and disrupt deployments of those applications.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment variables and build secrets, repoint sources, and disrupt other tenants' applications.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00317 24th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Dokploy	dokploy	up to 0.30.10	—	No fix listed	CNA

dokploy VendorDokploy Affected up to 0.30.10 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:dokploy:dokploy::::::::	—	—	Dokploy

cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:* Versions — — ·Dokploy

Remediation

The sources list no fixed version for dokploy.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

2026-10-25 Threatist record created from CVE-2026-116068
2026-10-26 CISA SSVC decision points changed
2026-10-26 Priority changed: MEDIUM → LOW
2026-10-26 Priority changed: LOW → MEDIUM
2026-10-27 Alias added: GHSA-w9rf-wg9h-jgwf

References

Patch 1

https://github.com/Dokploy/dokploy/commit/b3cd3c5061b9e4f9a786dc4a048765f79bae2523

Other 4

TI-2026-33375 Dokploy: Pre-Auth Admin Takeover via Hardcoded Authentication Secret CVSS 3.1CRITICAL 10.0
TI-2025-33717 Dokploy's Preview Deployments are vulnerable to Remote Code Execution CVSS 3.1CRITICAL 9.8
TI-2026-62972 Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root CVSS 3.1CRITICAL 9.9
TI-2026-58871 Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one CVSS 3.1CRITICAL 9.6
TI-2026-51118 Dokploy: Remote Code Execution via volume-backup CVSS 3.1CRITICAL 9.9
TI-2026-51110 Improper privilege management in dokploy CVSS 3.1CRITICAL 9.9

See all 58 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences