Dokploy: WebSocket handlers skip per-server authorization, giving any org member root terminals

Impact

The WebSocket handlers in terminal.ts, docker-container-terminal.ts, docker-container-logs.ts and docker-stats.ts check only that the caller belongs to the organization, never checkServiceAccess, accessedServerIds or accessedServices. Any authenticated organization member - including an account scoped to a single project - therefore gets a root shell on servers it was never granted, plus logs and stats for restricted services. Where Dokploy manages a mixed fleet, that is a full lateral move: root on the host means the Docker socket, every other tenant's containers, and any GPU device the host exposes. The per-server and per-service RBAC that the platform advertises is not enforced on these paths at all, so an operator's least-privilege model was never in effect.

Who can reach it

Authenticated but low privilege: any member of the Dokploy organization who can open a WebSocket to the Dokploy web app. No admin role, no server-level grant, and no local access to the managed host required.

What to do

Upgrade Dokploy to 0.29.13 and restart the app so the handlers enforce the access checks. Before that, treat every organization member as holding root on every managed server: cut the member list down to people who already have that trust, and put the Dokploy UI behind network restrictions so the WebSocket endpoints are not broadly reachable. After upgrading, rotate anything a root shell on the managed hosts would have exposed - registry credentials, deploy keys, environment secrets.

References

Related entries

• OpenChoreo: workflow parameters interpolated into sh -c run as commands in privileged build podsCVE-2026-73667 · OpenChoreo Workflow Plane (sample workflow templates, sh -c parameter interpolation)High
• OpenChoreo API: project-scoped users can exec into and read wirelogs of other projects' componentsCVE-2026-73841 · OpenChoreo openchoreo-api (component exec and wirelogs handlers)High
• KubeEdge CloudCore: unauthenticated node task status reports let anyone falsify node upgrade resultsCVE-2026-82473 · KubeEdge CloudCore (CloudHub HTTPS server, node task status endpoints)High
• KubeVirt: Path traversal lets a user who can configure KubeVirt read arbitrary host filesCVE-2022-1798 · KubeVirtHigh
• BuildKit: Race between parallel build steps sharing cache mounts with subpathsCVE-2024-23651 · BuildKitHigh
• OpenShift AI Data Science Pipelines Operator: over-broad ClusterRole turns operator compromise into cluster adminCVE-2026-18608 · Red Hat OpenShift AI Data Science Pipelines Operator (ClusterRole)High