CVE-2026-111331 Dokploy CVE debrief

Who should care

Dokploy users and administrators should assess exposure and verify port access restrictions to prevent potential disruptions and data breaches. This includes reviewing the Dokploy installation, restricting access to the port tRPC router, and implementing proper authorization checks for port management. Additionally, monitoring for suspicious port management activities and reviewing compensating controls for exposed systems is crucial.

Why it matters

CVE-2026-111331 is a medium-severity vulnerability in Dokploy that allows authenticated users to bypass authorization and manage other tenants' ports. Dokploy users and administrators should assess exposure, verify port access restrictions, and implement proper authorization checks to prevent potential disruptions and data breaches.

• Potential disruption of victim services due to unauthorized port management
• Possible data breaches or modifications due to bypassed authorization
• Need for verification of Dokploy installation and port access restrictions
• Potential for lateral movement or exploitation by attackers

Technical summary

Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router. Authenticated owners or admins of any organization can manage other tenants' ports by supplying a known portId or applicationId to port.create, port.one, port.update, or port.delete. This vulnerability allows for potential disruption of victim services, unauthorized port management, and data breaches. Dokploy users and administrators should assess exposure, verify port access restrictions, and implement proper authorization checks.

Defensive priority

Medium priority for Dokploy users; verify and restrict port access

Recommended defensive actions

• Verify Dokploy installation and restrict access to port tRPC router
• Implement proper authorization checks for port management
• Monitor for suspicious port management activities
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Official CVE Program record and NIST NVD detail page provide vulnerability metadata. Source item and supplemental sources offer technical details and references. The CVE record was published on 2026-10-15T21:43:34.445Z and has not been modified since then. Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router. Authenticated owners or admins of any organization can manage other tenants' ports by supplying a known portId or applicationId to port.create, port.one, port.update, or port.delete.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.