Dokploy WebSocket Unauthenticated RCE via Missing AuthZ (CVSS 9.9) Analysis

Vulnerability Overview A missing authorization issue exists in Dokploy’s WebSocket handlers. Specifically, the WebSocket handlers (such as the interactive terminal and log streaming) only validate the session but do not perform authorization checks. This means that any authenticated user can open an interactive shell to any container, including the container that mounts the Docker socket, thereby obtaining root privileges on the host, bypassing the application, and crossing tenant boundaries. Scope of Impact Affected Versions: (npm) <= 0.29.8 Fixed Versions: None Severity: Critical (9.9/10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Changed - Confidentiality: High - Integrity: High - Availability: High Remediation No fix is currently available. Vulnerability Details Root Cause Each WebSocket handler calls (authentication only) but never calls or . Authorization protects the rest of the application (e.g., calls it 31 times). The local handler branches ( ) also omit the organization ownership check, whereas the remote branches execute it correctly. Vulnerable Handlers (All in Their Local Branches) : SSH to the Docker host using the auto-generated key, with the from the query string controlled by the attacker. No role check is performed. : Runs via the Docker socket mounted by the container. No org/role scoping is enforced. and : Stream logs. No org/role scoping is enforced. Contrast: Remote Branches Enforce Ownership The local branch lacks equivalent code. Contradiction with Product’s Own RBAC Static member roles are in (no host access), and enforcement occurs at the IRPC layer via . The WebSocket handlers bypass this model. Self-Contained ID Enumeration ( ) is protected only by . Each member holds in their base role, with no application-level scope. The backend function injects the caller's application name into the grep pattern: The validator allows , so matches every line and returns every container on the host. This is an information disclosure issue, not command injection; all shell metacharacters are rejected. Escalation The container mounts , allowing the shell inside to drive the host daemon (host root). Combined with the host bind mount, this results in full host root access. Proof of Concept (POC) Prerequisites A self-hosted (non-cloud) instance at A member account: Capture its 1. Negative Control: Confirm Role Lacks Infrastructure Access 2. Enumerate Every Container ID (Member Has Only ) 3. Enter That Container (No Role Check) 4. Escalate to Host Root via Docker Socket (Read-Only / Non-Destructive) Alternative Vector (Without Socket Jump) When Dokploy runs as root, and the owner has used the local terminal at least once, the local SSH key is authorized as . Therefore, step 3 becomes direct host root access: Impact Broken Access Control / Missing Authorization leads to Remote Code Execution as root on the host and complete cross-tenant compromise. This can be exploited with a least-privilege authentication role and requires no user interaction. Affected: Any self-hosted instance with multiple users, any deployment with invited members; or any multi-organization instance. A member of one organization can enter containers from other organizations and take over the shared host. (Local container host paths are disabled on cloud instances.) The impact is amplified when combined with open settings/registration, which can allow initial account creation without authentication.

Goal Reached Thanks to every supporter — we hit 100%!

Dokploy WebSocket Unauthenticated RCE via Missing AuthZ (CVSS 9.9) Analysis

More from this source