A critical authorization bypass in Dokploy allows authenticated members to achieve root-level command execution within arbitrary containers on the host system.

This vulnerability occurs due to missing authorization checks in the docker-container-terminal component. While the request is authenticated, the system fails to validate if the user has permission to access the specified container, allowing any authenticated user to execute arbitrary commands as root via the docker exec function.

Successful exploitation grants an attacker full control over any container running on the self-hosted Dokploy instance. Given the CVSS score of 9.9, this represents a near-total compromise of the application environment, potentially leading to data exfiltration, service disruption, and lateral movement within the underlying infrastructure.

Immediate Action: Upgrade the Dokploy instance to version 0.29.13 or later immediately to incorporate the necessary authorization validation logic.

Proactive Monitoring: Review audit logs for unusual container access patterns or unexpected execution of shell commands within high-value containers.

Compensating Controls: Restrict access to the Dokploy dashboard to trusted users via network-level controls, such as VPNs or IP whitelisting, until the update is applied.

Public Exploit Available: No

This vulnerability presents a severe risk to the integrity and confidentiality of containerized workloads. Administrators should prioritize updating to version 0.29.13 immediately to eliminate the possibility of unauthorized root access.