UpHeron
All vulnerabilities

Servers and applications

GHSA-p8v8-6hm2-3w67

Sensitive Credential Leakage: GitHub Authentication Token (`ghs_`) Exposed in Discord Webhook Payloads

Severity
High 7.4
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.0
Weakness
Sensitive information in log files (CWE-532)
Attack
Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can
Read data · Change data
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Sources
Project advisories (GitHub)

Description

A sensitive credential exposure vulnerability exists in Dokploy's build notification system. When a build fails (in certain conditions), the application sends a notification to configured Discord webhooks. If a repository is cloned via HTTPS authentication, the Discord webhook payload includes the raw Git remote URL containing the short-lived GitHub App Installation Token (ghs_) in plain text. This allows any user or integration with access to the Discord channel or webhook logs to intercept the token and gain unauthorized access to the underlying GitHub repository.

During the application build process, Dokploy constructs a payload to transmit to an external Discord webhook URL. When logging or summarizing the build status, the application extracts the full Git remote repository URL.

When utilizing GitHub App authentication or automated deployment flows, this URL is constructed using the format: https://oauth2:[email protected]/owner/repo.git

From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.0

References