CVE-2026-72866

CVE-2026-72866 in Dokploy is an authorization bypass on a WebSocket terminal endpoint that allows any authenticated user to obtain an interactive shell on the Dokploy host by passing the sentinel value "local" as the server identifier. The CVSS 8.8 score significantly undersells the actual risk because it treats Dokploy as an isolated application server when in practice operators deploy it as their primary deployment control plane—a self-hosted PaaS that sits at the center of their infrastructure. The vulnerability pattern is a recognizable class of failure: developers create a privileged shortcut for management operations, reasoning that only authorized admins would use it anyway. The gap between "I am authorized right now" and "this code path enforces authorization" is where the vulnerability lives. The sentinel "local" receives different treatment than normal server identifiers, effectively bypassing role-based access controls. The blast radius matters more than the CVSS vector suggests. An interactive shell on the Dokploy host is not a terminal compromise—it is a pivot point. Dokploy manages application deployments and almost certainly holds credentials to container registries, SSH keys for deployed services, and sits with lateral network access to whatever it orchestrates. The Dokploy host operates with the implicit trust posture of the platform itself, not an application server. When the "local" bypass grants shell access, it defeats not just Dokploy's RBAC but every downstream authorization decision that assumed requests originated from the platform's control plane. The patch in version 0.29.13 warrants investigation: did it add authorization checks to the "local" branch, or remove it entirely? The historical pattern across similar CVEs suggests that adding role checks to a privileged exception path creates a maintenance burden where future authorization changes must remember to apply to this branch—future vulnerabilities breed in that gap. If the branch was removed entirely, legitimate operator workflows may need a proper admin shell mechanism, or operators will invent workarounds that recreate the same vulnerability class outside the audit trail. The disclosure problem compounds the risk. Dokploy's user base is predominantly solo developers and small teams who chose it for simplicity—not organizations with formal vulnerability management programs. These operators are unlikely to monitor Dokploy's GitHub releases or CVE feeds. The population of unpatched instances could be substantial and unaware, operating under the assumption that their self-hosted PaaS is not a high-value target. Anyone who installed Dokploy in the past six months is sitting in the exploitation window between when the tool became popular enough to attract adversaries and when operators have internalized the threat model.

Reviewed through automated stages and approved by a human before publication.