A critical authorization bypass in Dokploy allows authenticated users to obtain root-level access and escape tenant boundaries via insecure WebSocket handlers.

The application fails to perform role-based access control checks within WebSocket handlers for terminal and log streaming. An authenticated user can bypass authorization to gain access to containers, including those mounting the Docker socket, facilitating host-level root escalation.

This vulnerability enables total tenant isolation breakdown, meaning an attacker can move laterally across the entire platform. With a CVSS score of 9.9, the impact includes full system compromise, data exfiltration, and the ability to manipulate all hosted services. This represents an existential risk to the integrity and confidentiality of all hosted applications within the Dokploy environment.

Immediate Action: Upgrade to Dokploy version 0.29.13 or later to enforce correct authorization logic on all WebSocket sessions.

Proactive Monitoring: Monitor WebSocket traffic and shell session creation for anomalous activity originating from standard user accounts.

Compensating Controls: Restrict network access to the management interface and enforce strict session management to reduce the attack surface.

Public Exploit Available: No

Given the extreme severity and the availability of proof-of-concept information, immediate patching is required. Organizations must treat this as a high-priority remediation to prevent unauthorized host access.