CVE-2026-116068 Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116068?
CVE-2026-116068 is a high-severity vulnerability in dokploy, published on 25 Oct 2026.
Official description
Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment variables and build secrets, repoint sources, and disrupt other tenants' applications.
Weakness: CWE-639
Which versions are affected by CVE-2026-116068?
How do I fix CVE-2026-116068?
No fix has been published for CVE-2026-116068 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116068 being exploited?
There is no known exploitation of CVE-2026-116068 in the wild and no public exploit code.
Sources
Also known as GHSA-w9rf-wg9h-jgwf.