Insecure Direct Object Reference in Dokploy PaaS

CVE-2026-72867

What is CVE-2026-72867?

CVE-2026-72867 is a vulnerability affecting Dokploy, a free, self-hostable Platform as a Service (PaaS) designed to facilitate application deployment and management. This vulnerability results from incomplete server-side validation of branch fields within the Dokploy software, specifically versions 0.29.3 through 0.29.13. It allows low-privileged authenticated users to manipulate the deployment process by crafting malicious requests that specify custom branches. These crafted requests can then be leveraged to execute arbitrary commands on the host machine through shell-based Git clone commands. The lack of stringent validation implies that an attacker could potentially control significant aspects of the server environment, posing a severe security risk to organizations that rely on Dokploy for app management and deployment.

Potential impact of CVE-2026-72867

1. Arbitrary Code Execution: The vulnerability enables attackers to execute arbitrary commands on the host system. This could lead to complete compromise of the server, allowing unauthorized actions that could impact data integrity and availability.

2. Data Breaches: Given that the vulnerability allows hostile users to run commands, there is a significant risk of unauthorized access to sensitive data. Such data breaches could result in the exposure of confidential information, leading to potential regulatory violations and damage to reputation.

3. Service Disruption: Exploiting this vulnerability could also result in denial-of-service conditions, either through system overload or malicious alterations to deployed applications. This could severely impact business continuity and operational capacity for organizations utilizing Dokploy for their services.

References