CVE-2026-72886 — Dokploy Privilege Escalation via Host-Schedule Gate Bypass

Executive Summary

CVE-2026-72886 is a critical privilege escalation vulnerability in Dokploy, a self-hostable Platform as a Service (PaaS) solution, affecting versions 0.29.2 through 0.29.13. The vulnerability resides in the schedule.create and schedule.update handlers within the scheduled task management API, where an access control check for the owner/admin host-schedule gate is improperly scoped to an alternative code branch. This flaw allows an authenticated low-privileged member with access to a single application to create or modify a server-level schedule by attaching an applicationId belonging to an application they can access, resulting in script execution as the root user.

The CVSS score of 9.9 reflects the severity of this issue: a low-privileged attacker can achieve full host compromise with no user interaction, and the impact extends across availability, confidentiality, and integrity. Since no patch evidence is available from tracked sources as of this report, all affected deployments remain at risk unless the vendor has distributed a hotfix outside of public channels. The vulnerability requires no external exploit code to be weaponized — the legitimate API surface itself is the attack vector.

Technical Analysis

Dokploy implements a scheduled task (cron-like) management system through its API layer. The vulnerable endpoints, schedule.create and schedule.update, are defined in apps/dokploy/server/api/routers/schedule.ts. These endpoints accept parameters including applicationId and composeId to associate a scheduled job with a specific resource deployed on the platform.

The core defect is an authorization logic flaw involving the derivation of the serviceId from the supplied applicationId or composeId. The intended security model requires that the owner/admin host-schedule gate — a permission check that verifies the requesting user holds sufficient privileges to run schedules at the server-node level (i.e., as root on the host system) — must be enforced for any schedule that targets the host infrastructure. However, the implementation places this gate check exclusively within one conditional branch of the code. In the alternative branch, the serviceId is still derived from the applicationId but the permission assertion is never executed.

An authenticated user with member-level access to any single application on the Dokploy instance can leverage this logic gap. By supplying an applicationId for an application they legitimately control or can access, the user bypasses the administrative authorization check while still achieving server-level target resolution. The schedule is subsequently attached to the dokploy-server itself rather than to an application container, and the schedule.runManually method executes the attacker-supplied script with root privileges.

The root cause is fundamentally an authorization state-machine flaw: the privilege check and the resource resolution are decoupled in a way that permits an attacker to select a privileged execution target while presenting an unprivileged resource as the scheduling context. The vulnerability class is CWE-269 (Improper Privilege Management), as the system fails to ensure the user maintains the required privilege level for the actual operation performed.

Attack surface composition: this is a network-accessible, authenticated vulnerability. The attacker must be a registered platform member with access to at least one application. The exploit does not require any additional user privileges or interaction with secondary victims. The technical detail available in the NVD description is limited but sufficient to establish the flaw mechanism: improper placement of the authorization check relative to the input-derived resource identifier.

Exploitation Scenarios

The attack chain for this vulnerability is inferred from the CVE description and vulnerability class. No public PoC or exploit code has been identified at the time of this report.

Step 1 — Reconnaissance and Target Identification: The attacker first identifies a Dokploy instance exposed on the network. Open-source intelligence gathering may use Shodan queries such as title:"dokploy" to discover exposed instances. The target must be running Dokploy version 0.29.2 through 0.29.13. The attacker then enumerates the API surface and establishes an authenticated session using any valid member account. Membership can be obtained through legitimate registration, compromised credentials, or by being added to a project by an administrator.

Step 2 — Flaw Class Triggering: The attacker accesses the scheduling API, either through the web interface or directly via API calls to schedule.create or schedule.update. The attacker supplies an applicationId referencing an application to which they have been granted member-level access. Because the authorization gate for host-level schedule creation is only enforced in the branch that would be taken for compose-based schedules, the application-based schedule path proceeds without the required owner/admin permission verification.

Step 3 — Payload and Execution Method: The attacker attaches the malicious schedule to the dokploy-server node rather than to an application container. The schedule contains a script to be executed by the server's scheduling engine. The exact scripting parameters available to the attacker are not documented in the public advisory, but the NVD description confirms the impact is arbitrary script execution as root. After creating the schedule, the attacker invokes schedule.runManually to trigger immediate execution without waiting for the scheduled interval.

Step 4 — Post-Exploitation Impact: Once the script executes as root on the host node, the attacker has full control over the Dokploy server: complete filesystem access, ability to read all environment variables including database credentials and API keys for all deployed applications, and the capability to deploy malicious containers to any connected infrastructure. Using the compromised host, the attacker can pivot to attack any applications hosted on the platform, exfiltrate secrets from all tenants, and potentially use the platform's orchestration capabilities to propagate attacks to other nodes in the cluster.

Business impact scenarios include total confidentiality loss of all platform secrets, integrity compromise through arbitrary container deployment, and availability disruption via host-level denial-of-service or cryptocurrency-mining workloads.

Impact Assessment

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.9) indicates a critical severity vulnerability. The attack requires network access and low-privilege authentication but no user interaction. The scope is changed, meaning the compromised component (the schedule subsystem) impacts a security scope beyond its own authority — the entire host infrastructure. The confidentiality, integrity, and availability impacts are all rated high.

For a PaaS platform like Dokploy, the blast radius extends beyond a single application. A compromise of the scheduling component yields root-level access to the host system. From that position, an attacker can:

• Read and exfiltrate all environment secrets, database credentials, and application configuration for every deployed service.
• Modify, replace, or disable any deployed application container.
• Deploy malicious containers that blend into the platform's environment.
• Extract private keys and certificates used for TLS termination.
• Use the compromised host as a pivot point for lateral movement into connected backend services.
• Disrupt platform availability by terminating critical containers or exhausting host resources.

The vulnerable component is a single-user-account authorization gap, but the effective result is multi-tenant compromise. In a typical Dokploy deployment, multiple teams and potentially multiple customers share a single server node, amplifying the impact of this vulnerability across organizational boundaries. The requirement of only low-privilege access makes insider-threat scenarios — a disgruntled employee with minimal platform rights — particularly dangerous.

Detection Guidance

Sigma Rule

title: Dokploy Schedule Create/Update with Privilege Escalation Attempt
id: 6f4519c1-e65d-4b8a-8eb1-ff52c7f44aa2
status: experimental
description: Detects attempts to create or update schedules in Dokploy that may indicate exploitation of CVE-2026-72886 privilege escalation. Monitors for schedule creation associated with applicationId without corresponding host-schedule authorization.
author: vartersit.com Threat Intel
logsource:
  product: dokploy
  service: api
  category: application
detection:
  selection:
    endpoint:
      - "schedule.create"
      - "schedule.update"
    request.method: "POST"
  keyword:
    - "applicationId"
  filter_normal:
    user.role:
      - "owner"
      - "admin"
  condition: selection and not filter_normal
level: high
falsepositives:
  - Authorized admin users creating application schedules legitimately
  - API tooling that uses administrative service accounts
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026.72886

YARA Rule

rule Dokploy_CVE_2026_72886_Schedule_PrivEsc
{
    meta:
        author = "vartersit.com Threat Intel"
        description = "Detects Dokploy schedule request payloads referencing applicationId for server-level schedule operations"
        cve = "CVE-2026-72886"
        reference = "NVD - CVE-2026-72886"
        date = "2026-01-01"
    strings:
        $sched_create = "schedule.create"
        $sched_update = "schedule.update"
        $sched_run = "schedule.runManually"
        $app_id = "applicationId"
        $script_key = "script"
        $target_key = "server"
    condition:
        uint16(0) == 0x0D0A or uint32(0) == 0x0D0A0D0A or filesize < 1MB and
        (($sched_create or $sched_update) and $app_id and $script_key and $target_key) or
        ($sched_run and filesize < 10KB)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-72886 Dokploy schedule.create applicationId privilege escalation"; flow:established,to_server; content:"POST"; http_method; content:"schedule.create"; http_uri; content:"applicationId"; http_client_body; content:"script"; http_client_body; classtype:attempted-admin; sid:2026728861; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)
alert http any any -> any any (msg:"CVE-2026-72886 Dokploy schedule.update applicationId privilege escalation"; flow:established,to_server; content:"POST"; http_method; content:"schedule.update"; http_uri; content:"applicationId"; http_client_body; content:"script"; http_client_body; classtype:attempted-admin; sid:2026728862; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)
alert http any any -> any any (msg:"CVE-2026-72886 Dokploy schedule.runManually immediate execution"; flow:established,to_server; content:"POST"; http_method; content:"schedule.runManually"; http_uri; classtype:attempted-admin; sid:2026728863; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

any where process.name == "node" and event.action in ("exec", "spawn") and
  user.name != "root" and
  (
    process.args : "*schedule.create*" or
    process.args : "*schedule.update*" or
    process.args : "*schedule.runManually*"
  )

Splunk SPL Query

index=main sourcetype="dokploy:api"
  (uri="*/schedule.create" OR uri="*/schedule.update" OR uri="*/schedule.runManually")
  AND method=POST
  AND NOT (role=owner OR role=admin)
  | table _time, src_ip, user, uri, status, http_user_agent
  | stats count by src_ip, user, uri
  | where count > 3

Wazuh OSSEC Rule

<group name="dokploy,">
  <rule id="100486" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.*schedule\.create|schedule\.update</field>
    <description>Dokploy CVE-2026-72886 - Schedule creation by non-admin user</description>
    <group>attack.privilege_escalation,</group>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
  <rule id="100487" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.*schedule\.runManually</field>
    <description>Dokploy CVE-2026-72886 - Manual schedule execution by non-admin user</description>
    <group>attack.privilege_escalation,</group>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence Review: The NVD reports a patch confidence of 0/4, indicating that no patch evidence has been identified from any tracked source. While the NVD description explicitly states "This issue is fixed in version 0.29.13," this version has not been independently verified by any major security tracking repository. Security teams should verify the availability of version 0.29.13 through official vendor channels before relying on an upgrade path. If 0.29.13 is unavailable, the deployment remains fully vulnerable.

Immediate Mitigations:

1. Restrict membership: Immediately review all platform member accounts. Remove any accounts that do not require access. Lower-privileged accounts are the primary exploit vector.
2. Network segmentation: Restrict network access to the Dokploy instance. Place the web interface and API behind a VPN or strict allowlist rather than exposing it to the internet. Use egress filtering to block outbound connections from the Dokploy server to untrusted destinations, limiting the reachability of an attacker post-compromise.
3. Disable or restrict the scheduling API: If the team does not currently use scheduled tasks, consider disabling the schedule router entirely at the reverse proxy level by blocking requests to path patterns matching schedule. If schedule functionality is required, apply an application-layer firewall rule that only permits schedule creation/update operations from administrative source IPs.
4. Enable audit logging: Ensure all API requests are logged with user identity to enable post-incident investigation. If available, enable session recording for administrative and schedule-related actions.

Patch/Upgrade Steps:

1. Monitor official Dokploy release channels (GitHub releases, Docker Hub) for version 0.29.13 or later.
2. Before upgrading, review release notes to confirm the fix addresses the authorization check placement in apps/dokploy/server/api/routers/schedule.ts. The patch should ensure the owner/admin gate is applied in both the applicationId and composeId branches. Confirm the fixed version is signed and the container image is verified.
3. Perform a staged rollout in a test environment to verify the scheduled-task workflows still function properly after the fix.
4. After deployment, verify that a low-privilege member account is now denied the ability to create server-level schedules.

Long-Term Hardening:

1. Least-privilege design: Redesign the platform's role model so that schedule creation for host-level execution requires explicit cluster-admin or owner role. Avoid deriving privileges based on resource ownership alone.
2. Code review cadence: Institute a mandatory threat-modeling review for any endpoint that handles privileged execution or path-based operations. Standardize authorization checks to be centralized and applied before resource resolution.
3. Immutable infrastructure: Deploy the Dokploy server using infrastructure-as-code with read-only root filesystems where possible, making post-exploitation persistence more difficult.
4. Container isolation: Evaluate moving scheduled jobs into dedicated containers with restricted capabilities rather than allowing host-level script execution. Implement seccomp, AppArmor, or SELinux profiles for the schedule executor process.
5. Monitoring: Maintain the detection rules provided above in the organization's SIEM to monitor for future exploitation attempts. Update them as the patch becomes available and request patterns evolve.

References

1. NVD — CVE-2026-72886: https://nvd.nist.gov/vuln/detail/CVE-2026-72886
2. Dokploy Official Project (GitHub): https://github.com/Dokploy/dokploy — monitor for release 0.29.13 and security advisories.
3. Dokploy Documentation: https://dokploy.com/docs — reference for architecture and role management.
4. MITRE ATT&CK — T1068 Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
5. CWE-269 Improper Privilege Management: https://cwe.mitre.org/data/definitions/269.html

Exploit-in-the-Wild Evidence: No public exploit code, PoC, or observed in-the-wild exploitation campaigns have been identified at the time of this report. This may change rapidly once the vulnerability is more widely publicized; security teams should monitor incident reports for exploitation activity targeting exposed Dokploy instances.

Threat Actor Campaigns: No known threat actor campaigns have been attributed to this CVE at the time of writing. However, the privilege escalation chain described here follows patterns commonly used by initial-access brokers and ransomware affiliates who frequently target exposed PaaS management interfaces. Affected organizations should remain vigilant and treat any unusual schedule-related activity as a potential breach indicator.