Data Exposure in Dokploy Platform Affecting User Git Provider Secrets

CVE-2026-72873

What is CVE-2026-72873?

Dokploy, a self-hostable Platform as a Service (PaaS), contains a vulnerability where the 'application.one' endpoint exposes sensitive information. Specifically, prior to version 0.29.13, this endpoint returned Git provider secrets such as githubClientSecret, githubPrivateKey, and githubWebhookSecret to users with only 'service:read' permissions, even if 'hasGitProviderAccess' was false. This can allow unauthorized users to access critical Git provider secrets, compromising user security. The flaw was addressed in version 0.29.13, which prevents the exposure of these secrets.

References