← Back to the live CVE advisory feed

CVE-2026-116068: dokploy

Severity

8.7 (HIGH)

Vendor

DOKPLOY THROUGH

Affected versions

0 through 0.30.10

Patch status

Unknown

Published

2026-10-25T12:16:29.153

Modified

2026-10-25T12:16:29.277

Why it matters

This vulnerability poses a critical risk in multi-tenant Dokploy environments. An attacker with owner or admin privileges in one organization can bypass authorization to gain control over applications belonging to other tenants. This enables unauthorized modification of environment variables, access

Recommended admin actions

• Identify and inventory all Dokploy instances running versions up to 0.30.10 within your environment.
• Closely monitor application logs for any suspicious activity, especially unauthorized access attempts or modifications to other tenants' applications.
• Review and reinforce access control policies and tenant isolation mechanisms in your Dokploy deployment.
• Prepare to upgrade to a patched version as soon as it becomes available to remediate this authorization bypass.

Technical summary

Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment variables and build secrets, repoint sources, and disrupt other tenants' applications.

View the official NVD record for CVE-2026-116068

AI-enriched (HIGH confidence). Validate against the vendor advisory before taking production action.