Privilege Escalation Vulnerability in Dokploy PaaS by Dokploy
CVE-2026-72886

9.9CRITICAL

Key Information:

Vendor

Dokploy

Status
Dokploy
Vendor
CVE Published:
10 August 2026

What is CVE-2026-72886?

A privilege escalation vulnerability exists in Dokploy, a self-hostable Platform as a Service (PaaS), allowing users to manipulate the serviceId through their applicationId or composeId. This flaw affects versions 0.29.2 to 0.29.12, enabling a user with access to a single application to run arbitrary scripts as root via the dokploy-server's scheduling functions. The issue has been resolved in version 0.29.13, urging users to update promptly to mitigate risks.

Affected Version(s)

dokploy >= 0.29.2, < 0.29.13

References

https://github.com/Dokploy/dokploy/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/Dokploy/dokploy/pull/4869
x_refsource_MISC
https://github.com/Dokploy/dokploy/commit/1e3f10bd22c1c28...
x_refsource_MISC

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.