UpHeron
All vulnerabilities

Servers and applications

GHSA-fr95-6x4c-3c5g

Dokploy member users can read the global web-server SSH private key through settings.getWebServerSettings

Severity
Medium 6.5
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Sources
Project advisories (GitHub)

Description

Dokploy 0.29.13 allows any authenticated member user to call settings.getWebServerSettings and receive the global web-server settings object.

That object includes the stored sshPrivateKey value. The write endpoint for the same key is admin-only, but the read endpoint is only authenticated-user protected.

In my proof, an owner stores an SSH private key through the normal admin-only mutation. A default member user cannot overwrite that key, but the same member user can read it back through settings.getWebServerSettings.

The access-control boundary is inconsistent:

  • settings.saveSSHPrivateKey is an adminProcedure.
  • settings.getWebServerSettings is a protectedProcedure.
  • The returned settings object includes the sshPrivateKey field.

Relevant source locations in Dokploy 0.29.13:

  • apps/dokploy/server/api/routers/settings.ts:87: getWebServerSettings is registered as protectedProcedure.
  • apps/dokploy/server/api/routers/settings.ts:91: the full settings object is returned.
From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References