Servers and applications
GHSA-286g-v4cw-2x8v
Incomplete fix of GHSA-7r6p-v9gw-pwc8: listen-deployment.ts is named in that advisory but was never remediated — any authenticated member can stream host SSH private keys
- Severity
- High 7.7
- Published
- 12 Nov 2026
- Last changed
- 12 Nov 2026
- Added to UpHeron
- 12 Nov 2026
- Fixed in
- 0.31.1
- Attack
- Over the network · Needs a user account · No user action needed
- Attacker can
- Read data
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N- Sources
- Project advisories (GitHub)
Description
This is not a new vulnerability and I am not claiming it as one. GHSA-7r6p-v9gw-pwc8 already names apps/dokploy/server/wss/listen-deployment.ts in its "Vulnerable handlers" list. What is new is that the fix skipped that file, and it is still unauthorized at v0.30.2 — four weeks after publication.
Any authenticated organization member — with no role, no service grant and no docker permission — can open /listen-deployment and stream the contents of any file under /etc/dokploy, including the SSH private key Dokploy uses to reach the Docker host, Traefik certificate private keys, other applications' .env files and compose files. Recovering the host SSH key is host compromise.
Note also that GHSA-7r6p-v9gw-pwc8 records its affected range as <= 0.29.8, which reads as "fixed after 0.29.8". For this handler that is not the case, so users reading that advisory would conclude they are patched when they are not.
Affected software
| Software | Affected versions |
|---|---|
DokployServers and applications · github:dokploy/dokploy |
|
References
- GitHub Advisory Database https://github.com/advisories/GHSA-286g-v4cw-2x8v
- github.com https://github.com/Dokploy/dokploy/security/advisories/GHSA-286g-v4cw-2x8v