CVE-2026-72886criticalCWE-269CWE-863

CVE-2026-72886: critical vulnerability in dokploy

Dokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of CVE-2026-45632)

Published

Follow this CVE+ Monitor dokploy

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.9epss 0.5%
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.2 until 0.29.13, schedule.create and schedule.update in apps/dokploy/server/api/routers/schedule.ts derive serviceId from applicationId or composeId and execute the owner/admin host-schedule gate only in the alternative branch, allowing a member with access to one application to attach its applicationId to a dokploy-server schedule and run a supplied script as root through schedule.runManually. This issue is fixed in version 0.29.13.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
Dokploy · dokploy
Related CVEs — dokploy

In the same product, most dangerous first.

CVE-2026-72867CRITICALDokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts)EPSS 3.4%CVE-2026-24841CRITICALDokploy Vulnerable to Authenticated Remote Code Execution via Command Injection in Docker Container Terminal WebSocket EndpointEPSS 2.8%CVE-2026-27130CRITICALDokploy has Command Injection in its Service OperationsEPSS 1.2%CVE-2026-45633CRITICALDokploy: Command Injection in /docker-container-logs EndpointEPSS 1.1%CVE-2025-53376MEDIUMDokploy allows attackers to run arbitrary OS commands on the Dokploy host.EPSS 1.1%CVE-2026-45663CRITICALDokploy: Remote Code Execution via destinationPath in Container File UploadEPSS 1.1%