UpHeron
All vulnerabilities

Servers and applications

GHSA-vqmc-jp8m-qx86

/listen-deployment WebSocket has no service permission check - any member streams deployment logs of every service, including projects they have zero access to

Severity
High 7.1
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
Missing authorization (CWE-862)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read data · Change some data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Sources
Project advisories (GitHub)

Description

The /listen-deployment?logPath=... WebSocket only verifies the session is valid (plus the org of serverId for remote servers). It never checks the relationship between logPath and the caller's granted services. Any organization member streams (tail -f) deployment logs of every service, including services in projects they cannot even open in the UI. Build logs routinely echo environment variables, secrets, and connection strings.

apps/dokploy/server/wss/listen-deployment.ts:

  • Line 34: validateRequest(req) - identity only.
  • Line 44: readValidDirectory(logPath, serverId) - blocks traversal outside /etc/dokploy (charset whitelist plus resolved prefix) but does not gate on accessedServices.
  • Lines 49-52: session check runs after path validation (wrong order - an unauthenticated client gets a path-validity oracle through close code 4000 vs no code).
  • Lines 58-64: org check applies to a remote serverId only; local services (the majority) get no further check.
From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References