External risk intelligence

Dokploy Schedule Root Privilege Escalation Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-72886

Dokploy is a self-hostable Platform as a Service (PaaS) designed to manage application deployments. Such systems are typically deployed as internet-facing management consoles or centralized orchestration portals, making the API surface and web interface commonly accessible over the network to authorized users.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Dokploy, a self-hosted Platform as a Service, allows authenticated users to execute arbitrary scripts with root privileges. This could potentially lead to unauthorized system access and control by a member with existing application access. The primary concern is to confirm if this technology is in use and if it is exposed.

Unauthorized script execution via application access.
Confirms its presence and network exposure.
Assess relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with member access to a Dokploy application can manipulate schedule updates to attach their application's ID to a Dokploy server schedule. This allows them to execute arbitrary scripts with root privileges, potentially leading to a complete compromise of the server.

Requires authenticated member access.
Attaches unauthorized `applicationId` to schedule.
Allows arbitrary script execution as root.

Live Threat

Current exploitation, exposure, and threat context

A user with limited access to one application could potentially attach its `applicationId` to a Dokploy server schedule. When supported by the advisory, this could allow them to execute a supplied script with root privileges, impacting the integrity and availability of the underlying system.

System data and services at risk.
Unauthorized script execution via schedule.
Potential for data corruption or system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for self-hosted PaaS deployments, such as platform or infrastructure owners, should investigate this issue. The initial step is to identify all Dokploy instances, confirm their exposure and criticality, and then ascertain the accountable owner before planning remediation.

Platform/Infrastructure teams own the issue.
Verify Dokploy instance exposure and reachability.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dokploy?

Dokploy is a self-hosted Platform as a Service (PaaS) used by developers to manage, deploy, and orchestrate their applications. It functions as a centralized control panel that automates infrastructure tasks, allowing users to streamline the lifecycle of their services within their own hosting environment.

How does CVE-2026-72886 work?

This vulnerability involves improper access control and privilege management. Specifically, the system fails to correctly verify user permissions when creating or updating schedules. Because the validation logic for administrator-level tasks is bypassed, a standard user can manipulate the system to run arbitrary scripts with root-level privileges.

Does any user action trigger this CVE-2026-72886 flaw?

The flaw is triggered specifically when a user who already has member-level access to an application interacts with the scheduling API. It does not trigger for unauthenticated users, as the attack requires existing, authorized access to at least one application within the platform to successfully inject the unauthorized identifier.

Is my Dokploy instance at risk?

If you host Dokploy, you should consider the risk based on your deployment. Halo Surface Signal notes that Dokploy instances are typically internet-facing management consoles or centralized portals, which increases the likelihood that your API surface is accessible over the network. If your instance is reachable, it is a higher priority.

How can I secure my system against this vulnerability?

The primary response is to update your Dokploy installation to version 0.29.13 or later. Before applying the update, verify your current deployment version and ensure you have identified all instances of Dokploy running in your environment to ensure comprehensive coverage of the patch.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.