CVE-2026-72863

Executive Summary

CVE-2026-72863 is a critical authorization bypass vulnerability in Dokploy, a free, self-hostable Platform as a Service (PaaS) solution. The flaw exists in Dokploy's WebSocket handlers (in-app terminals and log streamers) which authenticate users via validateRequest() but fail to enforce the role/permission model that every tRPC procedure enforces. Any authenticated member, regardless of their assigned role, can open an interactive shell into any container on the host — including the Dokploy container that mounts the Docker socket — achieving root access on the underlying host and crossing all tenant boundaries. With a CVSS score of 9.9, this vulnerability poses an extreme risk to all Dokploy deployments running versions prior to 0.29.13.

Technical Analysis

The vulnerability resides in Dokploy's WebSocket handling layer, which serves two primary functions: in-app terminal sessions and log streaming. The attack mechanism is an authorization bypass at the session level — the key distinction between authentication and authorization.

Authentication vs. Authorization Gap: The WebSocket handlers call validateRequest() to establish the identity of the connecting user (authentication). However, after this identity verification, the handlers proceed to service the WebSocket connection without consulting the role/permission model that governs all other application operations. Every tRPC (TypeScript Remote Procedure Call) procedure in Dokploy enforces access control based on user roles and permissions. The WebSocket handlers, however, skip this critical step entirely.

Attack Surface: The WebSocket endpoints expose interactive terminal functionality and log streaming capabilities. These are intended to allow users to interact with containers they have been granted access to (e.g., applications they have deployed). Because the authorization check is missing, any authenticated user can request a terminal session on any container ID within the platform.

Container Escape Potential: Of particular concern is the Dokploy container itself, which mounts the Docker socket. An attacker who gains a shell inside this container can issue Docker API commands to the host's Docker daemon. Through container breakout techniques (e.g., mounting the host filesystem via a privileged container, using nsenter, or exploiting other Docker socket capabilities), an attacker can obtain root privileges on the host operating system.

Code-Level Context (Inferred from Description): The description explicitly names validateRequest() as the authentication mechanism used by both WebSocket handlers. The flaw is that this function is called for session establishment but the subsequent authorization check — which would normally call role/permission validation functions — is absent or bypassed in the WebSocket context. This represents a classic case of missing authorization checks on a critical communication channel, categorized under CWE-269 (Improper Privilege Management).

Version Scope: All Dokploy versions prior to 0.29.13 are affected. The vulnerability is fixed in version 0.29.13, which implies that the fix adds the missing authorization enforcement to the WebSocket handler layer.

Exploitation Scenarios

Attack Chain for CVE-2026-72863:

1) Reconnaissance / Target Identification:

• An attacker first identifies Dokploy instances exposed on the internet. Dokploy typically runs on port 3000 (default web interface).
• Shodan/Censys queries can surface instances using HTTP banners, login page titles, or TLS certificates associated with Dokploy.
• The attacker confirms the deployment version (e.g., via the login page footer, API responses, or error messages that may leak version information).

2) Authentication (Lowest Privilege):

• The attacker must have valid credentials for any account in the Dokploy instance. This could be a low-privilege member account, a collaborator, or a compromised account.
• Given that the requirement is merely "authenticated member," even the lowest-role account (e.g., a read-only viewer) is sufficient to trigger the vulnerability.
• The attacker authenticates to the platform through the standard web login flow, capturing a valid session token.

3) Triggering the Flaw (WebSocket Authorization Bypass):

• With an authenticated session token, the attacker initiates a WebSocket connection to the in-app terminal or log streamer endpoint.
• The WebSocket handshake includes the session token, which validateRequest() verifies — establishing the user's identity.
• Critically, the handler does NOT check whether the authenticated user has permission to access the target container. No role check, no tenant boundary validation, no ownership verification.
• The attacker supplies a container ID (e.g., the Dokploy container's ID, or any container on the host) and requests an interactive terminal session.

4) Post-Exploitation / Host Compromise:

• The attacker receives an interactive shell inside the target container. If targeting the Dokploy container, which mounts the Docker socket, the attacker now has access to Docker's control plane.
• Using Docker socket commands, the attacker can: create a privileged container with host filesystem mounts; extract host SSH keys; read secrets/environment variables from other containers; pivot to other containers and applications; achieve full host root access.
• Result: Complete compromise of the host, all containers, all tenant applications, data, and secrets. The attacker can also use the compromised host as a pivot point for lateral movement into the broader network.

Impact Summary: From a single low-privilege account, an attacker achieves root on the host operating system, crosses all multi-tenant boundaries, and gains full control of the PaaS infrastructure.

No public PoC is available; the attack chain is inferred from the vulnerability class and CVE description. However, the technical detail in the description (specifically naming validateRequest() and the container configuration) indicates a high-confidence assessment of the exploitation path.

Impact Assessment

Business Impact:

• Confidentiality: Complete loss. An attacker can read all container filesystems, host files, environment variables, secrets, API keys, and tenant data. CVSS subscore: H (High).
• Integrity: Complete loss. The attacker can modify any data, inject malicious code into any container, alter host files, and create backdoors. CVSS subscore: H (High).
• Availability: Complete loss. The attacker can shut down containers, stop services, encrypt data (ransomware), or destroy the host. CVSS subscore: H (High).

Blast Radius:

• Dokploy Deployment: Full compromise of the platform itself.
• Host OS: Root-level compromise of the underlying server.
• Tenants: All tenant applications and data are exposed. This is a multi-tenant breach — one user escalates to gain access to all tenants.
• Docker Ecosystem: All containers on the host are accessible, including any services connected via Docker networking.
• Lateral Movement: The compromised host can serve as a pivot into the broader internal network of the enterprise.

CVSS Analysis: The 9.9 score reflects: Network attack vector (AV:N) requiring only low privilege (PR:L), no user interaction (UI:N), and scope change (S:C) — meaning the compromise extends beyond the vulnerable component to affect resources in adjacent security contexts. All three impact metrics (C:H/I:H/A:H) are rated High.

CWE-269 (Improper Privilege Management): This maps to the failure to properly assign and enforce role-based permissions on the WebSocket communication channel.

Detection Guidance

Sigma Rule

title: Dokploy WebSocket Authorization Bypass - CVE-2026-72863
id: 5f7e9a12-3b4c-4d8e-9f6a-2c1b5d7e8f90
status: experimental
description: Detects attempts to exploit Dokploy CVE-2026-72863 - unauthorized WebSocket connections to terminal/log streamer endpoints
author: Valtersit Threat Intelligence
date: 2026/02/24
logsource:
  category: webserver
  product: nginx
  service: http
detection:
  selection_websocket:
    http.response.status_code: 101
    http.request.method: GET
  selection_paths:
    http.request.uri|contains:
      - '/terminal'
      - '/logs'
      - '/stream'
      - '/ws'
  selection_upgrade:
    http.request.headers|contains:
      - 'Upgrade: websocket'
      - 'Connection: Upgrade'
  condition: selection_websocket and selection_paths and selection_upgrade
level: high
falsepositives:
  - Legitimate terminal sessions by authorized users
  - Legitimate log streaming by authorized users
tags:
  - attack.t1213
  - cve.2026.72863
  - cwe.269

YARA Rule

rule Dokploy_WebSocket_Auth_Bypass_CVE_2026_72863
{
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2026-02-24"
        description = "Detects indicators of Dokploy CVE-2026-72863 exploitation"
        cve = "CVE-2026-72863"
        severity = "critical"
        reference = "NVD: CVE-2026-72863"
    strings:
        $a1 = "validateRequest" ascii wide nocase
        $a2 = "WebSocket" ascii wide nocase
        $a3 = "tRPC" ascii wide nocase
        $a4 = "docker.sock" ascii wide nocase
        $a5 = "term" ascii wide nocase
        $a6 = "stream" ascii wide nocase
        $a7 = "terminal" ascii wide nocase
        $b1 = "101 Switching Protocols" ascii wide nocase
        $b2 = "Sec-WebSocket-Protocol" ascii wide nocase
        $b3 = "Upgrade: websocket" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D and  // MZ header (PE file)
        (2 of ($a*) or 2 of ($b*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Dokploy WebSocket Authorization Bypass CVE-2026-72863"; flow:established,to_server; content:"GET"; http_method; content:"upgrade|3a|"; http_header_names; content:"websocket"; http_header_names; content:"Connection|3a|"; http_header_names; pcre:"/Upgrade:\s*websocket/i"; pcre:"/Sec-WebSocket-Protocol:\s*(chat|v1|json)/i"; classtype:attempted-admin; sid:2026022401; rev:1; metadata:created_at 2026_02_24, updated_at 2026_02_24, cve CVE-2026-72863; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-72863;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [network where event.action == "connection_initiated" and destination.port == 80 or destination.port == 443]
  [http where event.action == "request" and http.request.method == "GET" and 
   url.path in ("/terminal", "/logs", "/stream", "/ws") and
   http.request.headers contains "upgrade: websocket"]
  [process where event.action == "process_started" and process.name in ("docker", "nsenter", "nsinit")]

Splunk SPL Query

index=proxy OR index=web
  (url_path="/terminal" OR url_path="/logs" OR url_path="/stream" OR url_path="/ws")
  AND http_method="GET"
  AND headers.upgrade="websocket"
  | stats count by user, src_ip, dest_ip, url_path
  | where count > 5

Wazuh OSSEC Rule

<group name="dokploy,">
  <rule id="100240" level="12">
    <decoded>websocket</decoded>
    <field name="url" type="pcre2">/terminal|/logs|/stream|/ws</field>
    <description>Dokploy CVE-2026-72863: WebSocket authorization bypass attempt detected</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>dokploy, websocket, cve202672863</group>
    <info type="cve">CVE-2026-72863</info>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — No patch evidence from any tracked source. The vendor advisory confirms a fix exists in version 0.29.13, but no patch evidence from our tracked sources has been verified.

Immediate Mitigations (until patch can be applied):

1. Upgrade immediately to Dokploy 0.29.13 or later — This is the only definitive remediation. The fix introduces authorization enforcement in the WebSocket handlers.
2. Restrict network access — Limit access to the Dokploy web interface (default port 3000) to trusted IP ranges or VPN only. Do NOT expose it directly to the internet.
3. Implement multi-factor authentication (MFA) — The exploitation requires an authenticated account. MFA significantly raises the bar for attackers who have obtained credentials.
4. Disable WebSocket features if possible — If the in-app terminal and log streaming features can be disabled via configuration, do so until the patch is applied.
5. Monitor for anomalous WebSocket activity — Implement the detection rules provided in this report to identify potential exploitation attempts.
6. Audit user accounts — Review all user accounts and remove any unnecessary or dormant accounts. Enforce the principle of least privilege.

Patch/Upgrade Steps:

1. Follow Dokploy's official upgrade documentation (https://dokploy.com/docs/upgrade)
2. Back up all data, volumes, and configuration files
3. Deploy version 0.29.13 or later
4. Verify the WebSocket handlers now enforce authorization by: (a) creating a low-privilege test account, (b) attempting to connect to a terminal on a container outside the test account's scope, (c) confirming access is denied
5. After upgrade, rotate all secrets, API keys, and credentials that may have been exposed

Long-Term Hardening:

1. Network segmentation — Deploy Dokploy in an isolated network segment with strict egress controls.
2. Docker socket protection — Harden the Docker daemon: enable TLS for Docker API, restrict socket to localhost, use Docker's authorization plugin (e.g., Open Policy Agent integration) to enforce fine-grained Docker API permissions.
3. Container security hardening — Run containers with the principle of least privilege: drop capabilities, use read-only root filesystems, run as non-root users, disable privileged mode.
4. Application security review — Dokploy's custom application code should undergo periodic security audits, with particular focus on authentication and authorization flows across all communication channels (HTTP, WebSocket, gRPC).
5. Runtime monitoring — Deploy container runtime security tools (e.g., Falco, Sysdig Secure) to detect anomalous container behaviors such as privilege escalation attempts, unexpected process execution, or suspicious Docker socket usage.
6. Patch management — Establish a rigorous patch management process for all self-hosted infrastructure. Monitor vendor advisories (https://github.com/Dokploy/dokploy) and NVD for new releases.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72863
2. MITRE CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-72863
3. Dokploy Official Site: https://dokploy.com/
4. Dokploy GitHub Repository (for advisories and release notes): https://github.com/Dokploy/dokploy
5. Dokploy Upgrade Documentation: https://dokploy.com/docs/upgrade

Known Campaigns / Exploit-in-the-Wild: No exploit code has been observed in public repositories, and no known threat actor campaigns targeting this vulnerability have been reported at the time of writing. The "PoC/Exploit: UNKNOWN" status indicates insufficient evidence to confirm or deny active exploitation. Organizations running vulnerable versions should assume risk is imminent given the high CVSS score and low exploitation complexity.