Servers and applications

CVE-2026-127212

Dokploy < 0.31.1 Broken Access Control via readAppMonitoring

Severity: Medium 5.3
Published: 12 Nov 2026
Last changed: 12 Nov 2026
Added to UpHeron: 12 Nov 2026
Fixed in: 0.31.1
Weakness: Authorization bypass through a user-controlled key (IDOR) (CWE-639)
Attack: Over the network · Needs a user account · No user action needed
Attacker can: Read some data
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Sources: CVE Program

Description

Dokploy before 0.31.1 contains a missing ownership check vulnerability in the readAppMonitoring tRPC procedure that allows authenticated attackers to access container metrics belonging to other organizations by supplying an arbitrary appName. Attackers can query getApplicationStats with any application name, including the fixed "dokploy" control-plane service name, to read CPU, memory, network I/O, and block I/O metrics for containers they do not own on self-hosted multi-tenant instances.

From the CVE Program.

Affected software

Software	Affected versions
DokployServers and applications · `cna:dokploy\|dokploy`	Every version before 0.31.1

References

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-127212