CVE-2026-72734 Dokploy CVE debrief

Who should care

Administrators and owners of Dokploy instances should assess their exposure and verify that their instances are updated to version 0.29.13 or later. They should also review access controls for server deletion and monitor for suspicious activity.

Why it matters

CVE-2026-72734 is a high-severity vulnerability in Dokploy that allows unauthorized server deletion and exposure of sensitive information. Administrators and owners of Dokploy instances must assess their exposure, update to version 0.29.13 or later, and verify access controls to prevent exploitation.

• Unauthorized server deletion and disruption of Dokploy management
• Exposure of plaintext SSH private keys
• Potential data loss due to deleted server registration and deployment records
• Need for verification of organization ID validation for server deletion

Technical summary

The server.remove tRPC mutation in Dokploy's apps/dokploy/server/api/routers/server.ts is vulnerable to unauthorized server deletion. An authenticated owner or administrator with server:delete in one organization can delete another organization's server registration and deployment records by providing a caller-controlled serverId. This issue allows for interruption of Dokploy management and retrieval of the associated plaintext SSH private key.

Defensive priority

High

Recommended defensive actions

• Review and update Dokploy to version 0.29.13 or later
• Restrict access to server deletion functionality
• Monitor for suspicious server deletion activity
• Verify organization ID validation for server deletion
• Implement additional logging and monitoring for server deletion events
• Conduct a thorough review of current server configurations and access controls
• Establish a process for rapid response to potential security incidents involving server deletion

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Dokploy, a free, self-hostable Platform as a Service (PaaS). The issue is with the server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts, which accepts a caller-controlled serverId and calls several functions without verifying organization ID. This allows an authenticated owner or administrator with server:delete in one organization to delete another organization's server registration and deployment records, interrupt Dokploy management, and receive the associated plaintext SSH private key.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.