UpHeron
All vulnerabilities

Servers and applications

GHSA-rwpf-vrr8-6g7c

SSH private keys disclosed in full by sshKey.all and sshKey.one — the redactServerSshKey fix from #4857 never reached the sshKey router

Severity
High
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
Information exposure (CWE-200)Insufficiently protected credentials (CWE-522)
Sources
Project advisories (GitHub)

Description

sshKey.all and sshKey.one return the privateKey column verbatim to any caller holding sshKeys:read.

PR #4857 (merged 2026-07-20, shipped v0.29.13) established that returning SSH private key material to a caller who merely has read access on a resource is a vulnerability, and added redactServerSshKey for it. That helper is applied in exactly two places, both in the server router. The sshKey router — where the keys actually live — was never touched, so the same disclosure is still reachable one endpoint over.

Verified against canary as of 2026-08-07 and confirmed byte-identical in the v0.29.14 release. Also reproduced live against a self-hosted v0.29.1 instance.

apps/dokploy/server/api/routers/ssh-key.ts:84-89 — no columns projection, so every column including privateKey is returned for every key in the organization:

ssh-key.ts:71-83 — one returns the record raw. The organization check is present; redaction is not.

From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References