CVE-2026-72864

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13

Description An issue exists in the local branch of the '/docker-container-terminal' endpoint within the docker-container-terminal.ts file. While the system uses validateRequest() for authentication, it fails to authorize the containerId variable against the caller's role, organization, or service access before passing it to the docker exec command. This allows any authenticated member to obtain a root shell in arbitrary containers on a self-hosted instance.

Recommendations Update to version 0.29.13.