CVE-2026-72871 Dokploy CVE debrief

Who should care

Administrators and users of Dokploy installations prior to version 0.29.13 should assess exposure and verify remediation to prevent potential unauthorized GitHub App provider insertions.

Why it matters

CVE-2026-72871 is a high-severity issue in Dokploy that allows an attacker to insert a GitHub App provider containing sensitive material into another organization. This issue requires immediate attention from administrators and users of Dokploy installations prior to version 0.29.13.

• Potential unauthorized insertion of GitHub App providers
• Possible exposure of sensitive material, including client_secret, webhook_secret, and PEM private key material
• Required verification of Dokploy installations and GitHub App provider configurations
• Necessity to upgrade to Dokploy version 0.29.13 or later for remediation

Technical summary

CVE-2026-72871 is a high-severity issue in Dokploy, a free, self-hostable Platform as a Service (PaaS). Prior to version 0.29.13, the unauthenticated /api/providers/github/setup route trusts gh_init organizationId and userId values from the state parameter, allowing an attacker to insert a GitHub App provider containing client_secret, webhook_secret, and PEM private key material into another organization. This issue requires immediate attention from administrators and users of Dokploy installations prior to version 0.29.13 to assess exposure and verify remediation.

Defensive priority

Assess exposure, verify remediation

Recommended defensive actions

• Assess exposure to Dokploy installations prior to version 0.29.13
• Verify remediation by upgrading to Dokploy version 0.29.13 or later
• Review GitHub App provider configurations for potential unauthorized insertions
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the issue. The Dokploy team has released a fix in version 0.29.13. Evidence is limited to CVE and NVD entries. Defenders should verify Dokploy installations and GitHub App provider configurations for potential unauthorized insertions. The Dokploy team has provided a fix, and users should upgrade to version 0.29.13 or later. Additional review of GitHub App provider configurations is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.