Threats affecting pkg:github/dokploy/dokploy

Dokploy versions prior to 0.31.1 have a vulnerability in the readAppMonitoring tRPC procedure that lacks an ownership check. This flaw allows authenticated users to access container metrics of other organizations by specifying arbitrary application names. Attackers can retrieve CPU, memory, network I/O, and block I/O statistics for containers they do not own on self-hosted multi-tenant deployments.

CVE-2026-72868 is a critical OS command injection vulnerability in Dokploy versions prior to 0.29.13. It arises from unsafe interpolation of user-controlled fields into an rclone command executed via child_process.exec. This allows low-privileged organization members with create permissions on destinations to execute arbitrary commands in the root Dokploy container, which has access to the host Docker socket. The issue is fixed in version 0.29.13.