CVE-2026-72873 Dokploy CVE debrief

Who should care

Dokploy administrators and users with service:read permission should assess exposure and verify remediation to protect sensitive information. This includes reviewing user permissions, monitoring for unauthorized access, and ensuring proper access controls are in place.

Why it matters

CVE-2026-72873 allows users with service:read permission to retrieve Git provider secrets in Dokploy versions prior to 0.29.13, potentially exposing sensitive information.

• Verify exposure of Git provider secrets for Dokploy users
• Assess and limit service:read permission holders
• Monitor for unauthorized access to sensitive information

Technical summary

A vulnerability in Dokploy versions prior to 0.29.13 allows users with service:read permission to retrieve Git provider secrets, including githubClientSecret, githubPrivateKey, and githubWebhookSecret. This issue was addressed by implementing proper access controls in version 0.29.13. Dokploy administrators should assess exposure and verify remediation to protect sensitive information. The vulnerability does not require authentication beyond service:read permission, making it a significant risk for exposed systems.

Defensive priority

Assess exposure and verify remediation for Dokploy installations, prioritizing service:read permission holders.

Recommended defensive actions

• Verify Dokploy version and upgrade to 0.29.13 if necessary
• Assess user permissions and limit service:read access
• Monitor for unauthorized access to Git provider secrets
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry detail a vulnerability in Dokploy versions prior to 0.29.13, where a user with service:read permission can retrieve Git provider secrets. Evidence is limited to CVE and NVD details. Defenders should verify Dokploy version and user permissions, and monitor for unauthorized access to sensitive information with available logging.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.