CVE-2026-129433: Dokploy 9.9 — The Access Control Is the Member List
CVE-2026-129433 is a CVSS 9.9 authenticated RCE in Dokploy, the self-hosted Docker deployment platform. Vector: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H The PR:L requires an account. The S:C scope change crosses from the we
CVE-2026-129433 is a CVSS 9.9 authenticated RCE in Dokploy, the self-hosted Docker deployment platform.
Vector: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
The PR:L requires an account. The S:C scope change crosses from the web app to the Docker host. The result is root on the host — every container, every env var, every secret the team deployed.
Why PR:L is thin on a team platform: Dokploy's access model is an org member list. The precondition is the product's normal usage.
What to do:
- Upgrade to the fixed release (confirm versions from the Dokploy advisory)
- Audit the org member list — remove stale accounts, shared logins; enable MFA
- Treat the Docker host as tier zero — segment it, monitor it
- If exposed on a vulnerable version: rotate all secrets reachable from the host
The access control for this CVE is the member list. The audit is part of the fix the patch doesn't perform.
Full write-up: https://threataft.com/articles/cve-2026-129433-dokploy-authenticated-rce-docker
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.