Dokploy: Authorization bypass and tenant application manipulation (CVE-2026-116068)
Dokploy versions through 0.30.10 contain an authorization bypass vulnerability allowing authenticated owners or admins to manipulate and disrupt other tenants' applications via malformed applicationId requests.
CVE search metadata
CVE search record: CVE-2026-116068. Severity: high. CVSS: 8.8. KEV: no. Product: Dokploy (<= 0.30.10). Brief: Dokploy: Authorization bypass and tenant application manipulation (CVE-2026-116068). Brief link: https://feed.craftedsignal.io/briefs/2026-10-dokploy-auth-bypass/
Triage facts
Revision 1- Applicability
- Dokploy (<= 0.30.10)
- Evidence
- Unknown
- Severity
- High
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Oct 25, 12:28 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Dokploy versions up to and including 0.30.10 contain an authorization bypass vulnerability. The flaw resides in the application's handling of applicationId values during API requests. An authenticated user (owner or admin) of one organization can provide a foreign applicationId belonging to a different tenant to invoke administrative procedures.
Impact
Confirmed impact includes the ability for an attacker to overwrite environment variables and build secrets, modify source repository mappings, and perform disruptive actions such as deploying or stopping unauthorized applications across different tenant boundaries.
Recommendation
- Upgrade Dokploy to a patched version beyond 0.30.10 immediately.
- Audit logs for administrative API calls (specifically saveEnvironment, updateTraefikConfig, deploy, and stop) to identify suspicious cross-tenant application interactions.
- Temporarily restrict administrative access to the Dokploy interface until the patch is applied.
Immediate actions
Upgrade Dokploy to a version exceeding 0.30.10
Threat Hunt
Identify cross-tenant administrative API calls
Data: Application audit logs or web server access logs for API endpoints saveEnvironment, updateTraefikConfig, deploy, and stop
Mitigations
Upgrade Dokploy to fixed version
CVE-2026-116068