CVE-2026-45632: Dokploy: Schedule Authorization Bypass Enables Host/Server Command Execution

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-29 · updated 2026-10-06
Weakness: CWE-78

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.7 and earlier, the schedule router does not enforce organization/role checks. As a result, any authenticated user can create, update, run, or delete schedules belonging to other organizations if they know the scheduleId/serverId. Schedule types server and dokploy-server write and execute scripts on the host or remote servers, enabling RCE on the Dokploy host or a target server.

Affected products

dokploy: through 0.26.7

References

https://github.com/Dokploy/dokploy/security/advisories/GHSA-7wmr-57mg-h5q6
https://github.com/Dokploy/dokploy/security/advisories/GHSA-7wmr-57mg-h5q6

Get alerted when CVE-2026-45632 or the next vulnerability affects your stack