CVE-2026-72886 Dokploy CVE debrief

Who should care

Defenders responsible for Dokploy instances, particularly those with multiple applications and members, should assess exposure and apply the patch. They should also verify patch application and monitor for suspicious activity. Operators of Dokploy platforms and security teams should review the vulnerability and take necessary actions to protect their environments. Vulnerability management and security teams should prioritize this critical vulnerability and

Why it matters

CVE-2026-72886 is a critical vulnerability in Dokploy that allows for potential privilege escalation and compromise of Dokploy applications. Defenders responsible for Dokploy instances should assess exposure and apply the patch.

• Potential privilege escalation to root
• Lateral movement within Dokploy instances
• Compromise of Dokploy applications
• Verification of patch application required

Technical summary

The vulnerability is in the schedule.create and schedule.update endpoints in apps/dokploy/server/api/routers/schedule.ts, allowing a member with access to one application to attach its applicationId to a dokploy-server schedule and run a supplied script as root through schedule.runManually. This issue allows potential privilege escalation and compromise of Dokploy applications. The vulnerability is fixed in version 0.29.13, but exploitation details are limited. Defenders should prioritize verifying exposure and applying the patch.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability allows for potential privilege escalation.

Recommended defensive actions

• Verify Dokploy version and apply patch to 0.29.13 if vulnerable
• Restrict access to schedule.create and schedule.update endpoints
• Monitor schedule.runManually usage for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the CVE record and NVD entry. The issue is fixed in version 0.29.13. Limited details on exploitation and impact are available. Defenders should verify patch application and assess exposure. Evidence is limited to CVE and NVD entries. No additional information on exploitability or impact is provided. Official records indicate a critical vulnerability allowing potential privilege escalation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.