Dokploy (<= 0.30.10) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/dokploy--0.30.10/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 25 Oct 2026 12:28:21 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDokploy: Authorization bypass and tenant application manipulation (CVE-2026-116068)https://feed.craftedsignal.io/briefs/2026-10-dokploy-auth-bypass/Sun, 25 Oct 2026 12:28:21 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-dokploy-auth-bypass/Dokploy versions through 0.30.10 contain an authorization bypass vulnerability allowing authenticated owners or admins to manipulate and disrupt other tenants' applications via malformed applicationId requests.Dokploy versions up to and including 0.30.10 contain an authorization bypass vulnerability. The flaw resides in the application's handling of applicationId values during API requests. An authenticated user (owner or admin) of one organization can provide a foreign applicationId belonging to a different tenant to invoke administrative procedures.

Impact

Confirmed impact includes the ability for an attacker to overwrite environment variables and build secrets, modify source repository mappings, and perform disruptive actions such as deploying or stopping unauthorized applications across different tenant boundaries.

Recommendation

  • Upgrade Dokploy to a patched version beyond 0.30.10 immediately.
  • Audit logs for administrative API calls (specifically saveEnvironment, updateTraefikConfig, deploy, and stop) to identify suspicious cross-tenant application interactions.
  • Temporarily restrict administrative access to the Dokploy interface until the patch is applied.
]]>highadvisoryauthorization-bypasscloud-securityweb-application