GHSA-j7vw-q729-gm8m

The ai.getModels tRPC query accepts a fully user-controlled apiUrl (z.string().min(1), with no URL or host validation) and performs a server-side fetch(\${apiUrl}/models) from the Dokploy control-plane host, returning content parsed from the response back to the caller. The endpoint is a protectedProcedure — reachable by any authenticated user, including a base-tier organization member — and there is no SSRF protection anywhere in the codebase. A low-privilege user can therefore make the server issue arbitrary outbound HTTP(S) GET requests to internal-only hosts, cloud metadata services, and other resources the attacker cannot reach directly, and read response content back.

This was confirmed live: a base-tier organization member queried ai.getModels with apiUrl pointing at an internal-only service on the host's Docker network (not reachable from outside the host), and the Dokploy server fetched it and returned the service's payload to the member.