CVE-2026-72871

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13

Description The unauthenticated '/api/providers/github/setup' endpoint trusts organizationId and userId values provided via the state parameter. This occurs when the createGithub() function is called, allowing an attacker to inject a GitHub App provider—including the client secret, webhook secret, and PEM private key material—into a different organization.

Recommendations Update to version 0.29.13.