CVE-2026-72876

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13

Description Dokploy is a self-hostable Platform as a Service (PaaS). The application fails to perform an activeOrganizationId ownership check when processing the serverId parameter in the following API endpoints: swarm.getNodes, swarm.getNodeInfo, swarm.getAppInfos, and swarm.getNodeApps. Additionally, the getNodeInfo() function interpolates the nodeId variable into execAsyncRemote, which allows a user with server:read permissions to execute arbitrary commands as the configured SSH user on a server belonging to another tenant.

Recommendations Update to version 0.29.13.