Live › vulnerability › CVE-2026-116068
Go to dashboardDokploy through 0.30.10 does not check that an application belongs to the caller's organization, so an owner or admin can pass a foreign applicationId. An attacker can then overwrite another tenant's environment variables and build secrets, repoint its sources, and deploy or stop its applications.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 12:40 UTC. All times on this page are UTC.
Self-hosted Dokploy installs that serve more than one organization are exposed, because the bypass lets one tenant's owner or admin act on another tenant's applications. Single-organization installs have no other tenants to reach, so the risk there is limited to insiders with admin rights.
No product ranges from the sources yet.
0.30.10 or earlier.0.30.10; the sources do not name the fixed version, so check the project's release notes.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment variables and build secrets, repoint sources, and disrupt other tenants' applications.
This page as .md · .json · in your agent: get_signal("CVE-2026-116068")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.