UpHeron
All vulnerabilities

Servers and applications

GHSA-22qj-9936-gq2m

Remote deployment failures expose environment secrets in Dokploy container logs

Severity
High
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.0
Weakness
Sensitive information in log files (CWE-532)
Sources
Project advisories (GitHub)

Description

Dokploy logs the complete remote deployment command when remote command execution fails. Environment variables are embedded directly into that command, so sensitive values are written unredacted to the Dokploy service container logs.

This was observed on July 17, 2026 during a raw Docker Swarm Stack deployment to a remote server. The remote command failed before deployment because the SSH user could not create /etc/dokploy. Dokploy then logged an ExecError object containing its complete command property. The command contained production authentication tokens, application signing secrets, API credentials, and provider credentials. No real credential values are included in this report.

  • Dokploy running as a Docker Swarm service
  • Remote server connected over SSH
  • Application deployed as a raw Docker Stack
  • Environment variables configured through Dokploy

The service log contains an entry structurally equivalent to:

From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Workarounds

Restrict access to Dokploy and Docker logs, avoid forwarding them to broadly accessible collectors, and rotate credentials following failed deployments.

Workarounds as given by Dokploy/dokploy's security advisory.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.0

References