UpHeron
All vulnerabilities

Servers and applications

GHSA-86jc-q5q3-78vv

docker-container-terminal serviceId gate not bound to containerId (incomplete fix of CVE-2026-72864) - member with one service opens root shell in any org container

Severity
Critical 9.9
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.0
Weakness
Missing authorization (CWE-862)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Sources
Project advisories (GitHub)

Description

The fix for CVE-2026-72864 (GHSA-899j-cjwp-v4gw, v0.29.13) added a serviceId authorization path to /docker-container-terminal: when serviceId is present, the endpoint checks read access on that service and returns true. It never correlates the target containerId with the granted service. A member holding read access to a single service opens an interactive root shell (docker exec -it ... sh) in any container of the organization, including database containers of services they cannot access.

apps/dokploy/server/wss/authorize.ts:39-46:

apps/dokploy/server/wss/docker-container-terminal.ts:33-36: containerId and serviceId are independent query-string parameters. The remaining org check applies to serverId only (lines 70-75); the attacker stays in the same org anyway. containerId/shell pass charset validation (blocks injection, the CVE-2026-24841 class) but nothing validates ownership.

Same gap in docker-container-logs.ts (logs of any container) and docker-stats.ts.

From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.0

References