UpHeron
All vulnerabilities

Servers and applications

GHSA-w452-9gw6-323p

Failed builds and backups send every application secret in plain text to notifications

Severity
Medium 6.3
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
Information exposure through sent data (CWE-201)CWE-214Sensitive information in log files (CWE-532)
Attack
Over the network · Only under certain conditions · Needs a user account · No user action needed
Attacker can
Read data
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Sources
Project advisories (GitHub)

Description

When a Railpack build fails, Dokploy sends the full build command to every notification channel. That command holds every environment variable of the application as export NAME=value. So one failed build sends all application secrets in plain text to email, Slack, Discord, Telegram or a webhook.

Failed database backups do the same with the database password and the S3 destination keys. Dokploy also writes the same text to its own container log.

I saw this on v0.30.9 and read the same code in v0.30.10. I checked the Railpack builder and the database backups. I did not check the Nixpacks builder.

How the secrets get into the command:

  • packages/server/src/utils/builders/railpack.ts: for each environment variable, the builder adds export NAME= to the bash command. It also passes each variable to railpack prepare as --env NAME=value.
  • packages/server/src/utils/backups/utils.ts: getS3Credentials puts --s3-access-key-id and --s3-secret-access-key on the rclone command line.
From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References