CVE-2026-72734

Executive Summary

CVE-2026-72734 is an authorization bypass vulnerability (CWE-639 — Authorization Bypass Through User-Controlled Key) in Dokploy, a free, self-hostable Platform as a Service (PaaS) product. An authenticated user with owner or administrator privileges in one organization can exploit a missing serverId ownership check in the server.remove tRPC mutation to delete server registration and deployment records belonging to another organization, interrupt management operations, and potentially exfiltrate the associated plaintext SSH private key. The vulnerability affects Dokploy versions 0.28.7 through 0.29.13 and is fixed in version 0.29.13.

The vulnerability has a CVSS score of 8.4 (High), with a scope change (S:C) indicating that a compromise of one organization's data can affect resources beyond the original security scope. The attack requires low privileges (authenticated user with server:delete permission) but has a high attack complexity due to the requirement that the attacker must have previously observed another organization's serverId. The network-accessible attack vector makes this particularly relevant for internet-exposed Dokploy instances. No public PoC, exploit code, or Nuclei template is currently available, and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.

Technical Analysis

Vulnerability Mechanism

Dokploy implements a multi-tenant architecture where organizations maintain isolated resources, including server registrations and deployment records. The application uses tRPC, a TypeScript-based remote procedure call framework, to expose server management operations to authenticated clients. The vulnerable code path is in the server.remove mutation, located in apps/dokploy/server/api/routers/server.ts.

The vulnerability stems from an incomplete authorization check in the server.remove mutation. The mutation accepts a caller-controlled serverId parameter and performs the following sequence of operations:

1. haveActiveServices — checks whether the target server has active services
2. findServerById — retrieves the server record by ID
3. removeDeploymentsByServerId — removes deployment records associated with the server
4. deleteServer — deletes the server registration

Critically, none of these operations verify that currentServer.organizationId equals ctx.session.activeOrganizationId. This means the authorization context (the authenticated user's active organization) is never compared against the organization ownership of the server being deleted. The server.one query (a read operation) properly enforces this cross-organization check, but the server.remove mutation does not.

Attack Surface

The attack surface is the authenticated tRPC API endpoint for server removal. The vulnerability is exploitable by:

• Authenticated users with server:delete permission in any organization
• Users with owner or administrator roles (these roles typically possess the server:delete permission)
• Users who have previously observed the target server's ID (via enumeration, log review, shared infrastructure, or legitimate cross-organization visibility)

Technical Details

The vulnerability class is Insecure Direct Object Reference (IDOR) / Authorization Bypass Through User-Controlled Key (CWE-639). The application uses user-supplied identifiers (serverId) to directly reference server objects without first validating the caller's authorization to access that specific object.

The missing validation allows:

• Cross-organization deletion: An attacker in Organization A can delete servers registered to Organization B by supplying the victim's serverId
• Data destruction: Deployment records associated with the deleted server are also removed
• Credential exposure: The attacker may receive the plaintext SSH private key associated with the deleted server, even though the server.one read operation would deny the same cross-organization access

Exploitation Scenarios

Attack Chain

The exploitation of CVE-2026-72734 follows a multi-step process. No public PoC is available; this attack chain is inferred from the vulnerability class and the NVD description.

Step 1: Reconnaissance and Target Identification

The attacker, an authenticated owner or administrator with server:delete permission in their own organization, must first obtain another organization's serverId. Methods to observe this identifier include:

• Reviewing shared infrastructure or logs where server IDs may have been inadvertently exposed
• Social engineering of cross-tenant administrative personnel
• Exploiting any API endpoints that inadvertently leak server identifiers (though the server.one read prevents direct cross-org reads)
• Default or predictable server ID enumeration (if the ID scheme is sequential or patterned)

Step 2: Flaw Triggering

The attacker crafts a malicious tRPC request to the server.remove mutation, supplying the victim organization's serverId as the caller-controlled parameter. Because the mutation does not validate that the currentServer.organizationId matches ctx.session.activeOrganizationId, the request passes authorization checks.

Step 3: Payload/Execution at Vulnerability-Class Level

At the vulnerability-class level, this is an IDOR/authorization bypass. The attacker invokes the delete operation with a foreign object identifier. The server-side logic processes the request without performing the required ownership check, executing the deletion workflow: haveActiveServices, findServerById, removeDeploymentsByServerId, and deleteServer.

Step 4: Post-Exploitation Impact

Successful exploitation results in:

• Deletion of the victim organization's server registration — the server disappears from Dokploy management
• Deletion of associated deployment records — losing deployment history and configuration
• Potential exfiltration of plaintext SSH private key — the key used to access the victim's server is exposed to the attacker, enabling direct server compromise
• Denial of service — interruption of the victim's ability to manage their Dokploy infrastructure

Impact Assessment

Business Impact

The CVSS score of 8.4 (High) reflects the severity of this vulnerability:

• Confidentiality (C:H) — High confidentiality impact: The plaintext SSH private key associated with the victim's server can be exposed to the attacker, enabling direct access to the underlying infrastructure
• Integrity (I:H) — High integrity impact: The attacker can delete server registrations and deployment records, corrupting the victim's infrastructure configuration
• Availability (A:L) — Low availability impact: The deletion interrupts Dokploy management capabilities but may not result in complete service loss
• Scope (S:C) — Changed scope: A compromise in one organization's tenant can affect resources beyond the original security scope, impacting other organizations' infrastructure

Affected Systems

All Dokploy installations running versions 0.28.7 through 0.29.13 are affected. This includes:

• Self-hosted Dokploy instances deployed by enterprises
• Managed Dokploy services where multiple organizations share a single instance
• Internet-exposed Dokploy management panels

Blast Radius

The blast radius includes:

• Multi-tenant environments: Any organization sharing a Dokploy instance is at risk of cross-tenant attacks
• Infrastructure compromise: The SSH private key exposure enables direct server-level compromise
• Data loss: Deployment records and server configurations may be permanently lost

Detection Guidance

Sigma Rule

title: Dokploy Cross-Organization Server Deletion Attempt
id: 66a3f2cf-1e5e-4d7e-9e3a-7b7d09e2b6a1
status: experimental
description: Detects attempts to exploit CVE-2026-72734 - unauthorized server removal in Dokploy
author: Valtersit Threat Intelligence
logsource:
  category: application
  product: dokploy
  service: server
detection:
  selection_delete:
    event.action: 'server.remove'
  selection_cross_org:
    event.outcome: 'success'
  condition: selection_delete and selection_cross_org
  timeframe: 5m
falsepositives:
  - Legitimate server removals by authorized administrators in their own organization
level: high
tags:
  - attack.impact
  - attack.credential_access
  - cve.2026.72734
  - cwe.639

YARA Rule

rule dokploy_cve_2026_72734_ida
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects artifacts related to CVE-2026-72734 - Dokploy authorization bypass"
        cve = "CVE-2026-72734"
        date = "2026-01-01"
        severity = "high"
    strings:
        $s1 = "server.remove" ascii wide nocase
        $s2 = "removeDeploymentsByServerId" ascii wide nocase
        $s3 = "deleteServer" ascii wide nocase
        $s4 = "findServerById" ascii wide nocase
        $s5 = "haveActiveServices" ascii wide nocase
        $s6 = "serverId" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D and 2 of ($s*) or 3 of ($s*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET WEB_SPECIFIC_APPS Dokploy CVE-2026-72734 Cross-Organization Server Delete Attempt"; flow:established,to_server; http.uri; content:"/trpc"; http.uri; content:"server.remove"; http.method; content:"POST"; http.request_body; content:"serverId"; pcre:"/"serverId"\\s*:\\s*"[^"]+"/"; classtype:attempted-admin; sid:202672734; rev:1; metadata:created_at 2026-01-01, updated_at 2026-01-01, cve CVE-2026-72734;)

Elastic Detection

POST /query
{
  "query": {
    "bool": {
      "must": [
        {"term": {"event.category": "api"}},
        {"term": {"event.action": "server.remove"}},
        {"match": {"message": "removeDeploymentsByServerId"}},
        {"match": {"message": "deleteServer"}}
      ],
      "filter": [
        {"term": {"user.roles": "owner"}},
        {"term": {"user.roles": "administrator"}}
      ]
    }
  }
}

Splunk SPL Query

index=dokploy sourcetype=dokploy:api
| where event_action="server.remove"
| eval org_match = if(server_organization_id == active_organization_id, "ok", "cross_org")
| where org_match == "cross_org"
| stats count by user, src_ip, dest_ip, serverId, activeOrganizationId
| table user, src_ip, dest_ip, serverId, activeOrganizationId, count

Wazuh OSSEC Rule

<group name="dokploy,">
  <rule id="100934" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.action">server.remove</field>
    <field name="user.roles">owner|administrator</field>
    <description>Dokploy: Cross-organization server deletion attempt (CVE-2026-72734)</description>
    <group>cve-2026-72734,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

While the NVD description states the issue is fixed in version 0.29.13, our patch confidence assessment indicates that no vendor advisory, patch commit, or release notes have been verified by tracked sources. Organizations should verify the availability of version 0.29.13 from official Dokploy channels before relying on this fix.

Immediate Mitigations

1. Restrict access to the Dokploy management interface — Limit access to the administrative panel to a trusted network segment using firewall rules or network-level access control lists (ACLs). Do not expose the management interface directly to the internet.
2. Enforce strong authentication — Require multi-factor authentication (MFA) for all Dokploy accounts with owner or administrator roles.
3. Rotate SSH keys and credentials — Given the potential for SSH private key exposure, rotate all SSH keys stored within Dokploy, especially those associated with production servers.
4. Audit organization membership — Review all existing organizations and their user memberships to identify and remove any dormant or suspicious accounts.

Patch/Upgrade Steps

1. Upgrade to Dokploy version 0.29.13 or later. This version addresses the missing authorization check in the server.remove mutation.
2. Before upgrading, back up the Dokploy database and configuration files to ensure rollback capability if issues arise.
3. After upgrading, verify that the authorization check is enforced by attempting to access a server from a different organization (testing should be performed only in a controlled staging environment).

Long-Term Hardening

1. Implement network segmentation — Place Dokploy behind a reverse proxy or VPN and restrict access to the management interface to authorized personnel only.
2. Enable comprehensive logging — Configure audit logging for all tRPC API calls, particularly delete operations, to enable post-incident forensics.
3. Apply the principle of least privilege — Review and minimize the number of users with server:delete permission; use role-based access control (RBAC) to restrict privileges to only those who require them.
4. Monitor for CISA KEV additions — Re-check the CISA Known Exploited Vulnerabilities catalog regularly, as this vulnerability may be added if in-the-wild exploitation is observed.
5. Establish a credential rotation policy — Regularly rotate SSH keys and credentials stored within Dokploy to limit the impact of potential exposure.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72734 — Official NVD listing with the CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L) and CWE classification (CWE-639).

2. Dokploy GitHub Repository: https://github.com/Dokploy/dokploy — Source repository containing the vulnerable code path in apps/dokploy/server/api/routers/server.ts. Monitor for the release of version 0.29.13 and the associated fix.

3. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — This vulnerability is NOT currently listed in the KEV catalog. Re-check regularly for updates.

4. FIRST.org EPSS: https://www.first.org/epss/ — EPSS score is not yet available for this CVE. Monitor for scoring once the vulnerability gains broader visibility.

5. AtomicReader / Other Threat Intel Sources: Standard CVE monitoring feeds will provide updated intelligence as the vulnerability matures and if exploit activity is observed.

Threat Actor Campaigns / In-the-Wild Exploitation: No known threat actor campaigns or exploit-in-the-wild evidence has been reported for CVE-2026-72734 at the time of this writing. The exploitation is inferred from the vulnerability class (IDOR/authorization bypass) and the detailed code path described in the NVD entry.