Dokploy has 5 CVEs on record. 5 were published in the last 90 days. The median CVSS is 9.6 (critical), with 3 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 9.6
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Worst active — by depth score
CVE-2026-93425Critical· 9.9Dokploy is a free, self-hostable Platform as a Service (PaaS)67CVE-2026-72733Critical· 9.9Dokploy is a free, self-hostable Platform as a Service (PaaS)67CVE-2026-86059Critical· 9.6Dokploy is a free, self-hostable Platform as a Service (PaaS)65CVE-2026-116068High· 8.8Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router48CVE-2026-111331Medium· 6.3Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any organization to manage other tenants' ports because the target application's organization…47
Dokploy vulnerabilities
CVEs affecting Dokploy, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-116068High· 8.8Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router
Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like …
CVE-2026-111331Medium· 6.3PoCDokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any organization to manage other tenants' ports because the target application's organization…
Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any organization to manage other tenants' ports because the target application's organization…
CVE-2026-93425Critical· 9.9PoCDokploy is a free, self-hostable Platform as a Service (PaaS)
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in…
CVE-2026-86059Critical· 9.6PoCDokploy is a free, self-hostable Platform as a Service (PaaS)
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintext provider credentials through github.one, gitlab.one, gitea.one, and bitbucke…
CVE-2026-72733Critical· 9.9PoCDokploy is a free, self-hostable Platform as a Service (PaaS)
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backupFile fields witho…