GHSA-m68g-xqqg-jmf5

Database, Compose and volume backups pass the S3 destination credentials to rclone as command-line flags. When the backup command fails, Node.js puts the full command in error.message, and Dokploy sends this message unredacted to every enabled notification channel (email, Slack, Discord, Telegram, webhook...). Anyone who can read the channel gets the access key and secret key of the backup destination, which usually holds every database backup of the instance. The web server backup already redacts this message, the other backup types do not.

Affected version: branch canary, commit e0c8d80cdea15a4ac3fe495a6ad38e043b4b80b5 (17 October 2026). The Dokploy image runs Node.js 24.4.0.

Credentials on the command line:

• packages/server/src/utils/backups/utils.ts, lines 71 to 81: getS3Credentials() returns --s3-access-key-id= and --s3-secret-access-key=.
• packages/server/src/utils/backups/utils.ts, line 268: rclone rcat ${rcloneFlags.join(" ")} ... is embedded in the backup command.