CVE-2026-127212 · Package
NO FIX YET · SEE WHAT TO DO
Dokploy's readAppMonitoring procedure does not check that the caller owns the application named in the request. An authenticated user can read CPU, memory, network and block I/O metrics for containers belonging to other organizations.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted Dokploy instances serving multiple organizations are exposed, because any logged-in user can query metrics for applications by name. Single-tenant installs where every user belongs to the same organization are less exposed.
Not affected if managed-hosting, single-tenant
Who cares dokploy, multi-tenant, self-hosted
0.31.1.0.31.1 or later.Dokploy before 0.31.1 contains a missing ownership check vulnerability in the readAppMonitoring tRPC procedure that allows authenticated attackers to access container metrics belonging to other organizations by supplying an arbitrary appName. Attackers can query getApplicationStats with any application name, including the fixed "dokploy" control-plane service name, to read CPU, memory, network I/O, and block I/O metrics for containers they do not own on self-hosted multi-tenant instances.
This page as .md ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.