{"id":"CVE-2026-127212","kind":"vulnerability","aliases":["CVE-2026-127212"],"related":[],"title":"Dokploy: missing ownership check exposes other organizations' container metrics","description":"Dokploy before 0.31.1 contains a missing ownership check vulnerability in the readAppMonitoring tRPC procedure that allows authenticated attackers to access container metrics belonging to other organizations by supplying an arbitrary appName. Attackers can query getApplicationStats with any application name, including the fixed \"dokploy\" control-plane service name, to read CPU, memory, network I/O, and block I/O metrics for containers they do not own on self-hosted multi-tenant instances.","summary":"Dokploy's readAppMonitoring procedure does not check that the caller owns the application named in the request. An authenticated user can read CPU, memory, network and block I/O metrics for containers belonging to other organizations.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dokploy","multi-tenant","package","self-hosted"],"not_affected_if":["managed-hosting","single-tenant"],"how_to_check":"- Check the installed Dokploy version; affected versions are those before `0.31.1`.\n- Confirm whether the instance is multi-tenant, with more than one organization on the same self-hosted Dokploy install.","fix":"- Dokploy: move to `0.31.1` or later.","status":"open","published_at":"2026-11-13T00:20:13+00:00","first_seen_at":"2026-11-13T00:41:07+00:00","triaged_at":"2026-11-13T00:41:20+00:00","updated_at":"2026-11-13T00:41:20+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T00:41:20Z","model":"claude-haiku-5-5","output":{"fix":"- Dokploy: move to `0.31.1` or later.","reach":"internet","title":"Dokploy: missing ownership check exposes other organizations' container metrics","impact":"low","summary":"Dokploy's readAppMonitoring procedure does not check that the caller owns the application named in the request. An authenticated user can read CPU, memory, network and block I/O metrics for containers belonging to other organizations.","audience":"businesses","category":"package","nicknames":[],"who_cares":["dokploy","self-hosted","multi-tenant"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user reads other tenants' container resource metrics","analyst_note":"unknown","how_to_check":"- Check the installed Dokploy version; affected versions are those before `0.31.1`.\n- Confirm whether the instance is multi-tenant, with more than one organization on the same self-hosted Dokploy install.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["single-tenant","managed-hosting"],"who_is_affected":"Self-hosted Dokploy instances serving multiple organizations are exposed, because any logged-in user can query metrics for applications by name. Single-tenant installs where every user belongs to the same organization are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000709,"input_tokens":4676,"output_tokens":482,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-127212':12A,15A '-2026':11A,14A '0.31.1':61C 'access':78C 'allow':74C 'applic':36B,96C 'appnam':89C 'arbitrari':88C 'attack':76C,90C 'authent':42B,75C 'belong':55B,81C 'block':50B,114C 'caller':33B 'check':4A,30B,66C 'contain':8A,54B,62C,79C,118C 'control':103C 'control-plan':102C 'cpu':46B,109C 'cve':10A,13A 'dokploy':1A,16B,24B,59C,101C 'expos':5A 'fix':100C 'getapplicationstat':93C 'host':23B,126C 'i/o':51B,112C,115C 'includ':98C 'instanc':130C 'memori':47B,110C 'metric':9A,52B,80C,116C 'miss':2A,64C 'multi':18B,128C 'multi-ten':17B,127C 'name':37B,97C,106C 'network':48B,111C 'organ':7A,58B,84C 'own':34B 'ownership':3A,65C 'packag':20B 'plane':104C 'procedur':27B,72C 'queri':92C 'read':45B,108C 'readappmonitor':26B,70C 'request':40B 'self':22B,125C 'self-host':21B,124C 'servic':105C 'suppli':86C 'tenant':19B,129C 'trpc':71C 'user':43B 'vulner':67C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Dokploy instances serving multiple organizations are exposed, because any logged-in user can query metrics for applications by name. Single-tenant installs where every user belongs to the same organization are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dokploy","medium","multitenant","package","selfhosted"],"campaign_type":null,"search_a":"'-127212':12A,15A '-2026':11A,14A 'check':4A 'contain':8A 'cve':10A,13A 'dokploy':1A 'expos':5A 'metric':9A 'miss':2A 'organ':7A 'ownership':3A","search_b":"'applic':36B 'authent':42B 'belong':55B 'block':50B 'caller':33B 'check':30B 'contain':54B 'cpu':46B 'dokploy':16B,24B 'host':23B 'i/o':51B 'memori':47B 'metric':52B 'multi':18B 'multi-ten':17B 'name':37B 'network':48B 'organ':58B 'own':34B 'packag':20B 'procedur':27B 'read':45B 'readappmonitor':26B 'request':40B 'self':22B 'self-host':21B 'tenant':19B 'user':43B","search_c":"'0.31.1':61C 'access':78C 'allow':74C 'applic':96C 'appnam':89C 'arbitrari':88C 'attack':76C,90C 'authent':75C 'belong':81C 'block':114C 'check':66C 'contain':62C,79C,118C 'control':103C 'control-plan':102C 'cpu':109C 'dokploy':59C,101C 'fix':100C 'getapplicationstat':93C 'host':126C 'i/o':112C,115C 'includ':98C 'instanc':130C 'memori':110C 'metric':80C,116C 'miss':64C 'multi':128C 'multi-ten':127C 'name':97C,106C 'network':111C 'organ':84C 'ownership':65C 'plane':104C 'procedur':72C 'queri':92C 'read':108C 'readappmonitor':70C 'self':125C 'self-host':124C 'servic':105C 'suppli':86C 'tenant':129C 'trpc':71C 'vulner':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T08:15:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127212","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127212","severity":null,"published_at":"2026-11-13T00:20:13+00:00","modified_at":"2026-11-13T00:20:13+00:00","first_seen_at":"2026-11-13T00:41:07+00:00","fetched_at":"2026-11-13T00:41:07+00:00","note":null}],"documents":[{"id":140888,"url":"https://github.com/Dokploy/dokploy/releases/tag/v0.31.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":140889,"url":"https://github.com/Dokploy/dokploy/security/advisories/GHSA-vxxh-2cp7-gr59","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-12T08:15:57+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":140890,"url":"https://www.vulncheck.com/advisories/dokploy-broken-access-control-via-readappmonitoring","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}