Dokploy Authorization Bypass Enables Cross-Tenant Application Control

Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment variables and build secrets, repoint sources, and disrupt other tenants' applications.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Dokploy versions through 0.30.10 suffer from a critical authorization bypass vulnerability that allows authenticated owners or admins to manipulate applications belonging to other tenants by directly supplying foreign applicationId values. This vulnerability is particularly dangerous because it operates within what should be a privileged, trusted tier—attackers don't need to breach authentication, only exploit insufficient authorization checks. Organizations using Dokploy for multi-tenant deployments face immediate risk of environment variable exfiltration, secrets compromise, deployment disruption, and lateral movement across tenant boundaries. Any organization running Dokploy 0.30.10 or earlier with multiple tenants should treat this as a high-priority remediation item.

Casky's 283 matching skills map this vulnerability to MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access), detecting the attack patterns through extended reasoning across multiple vectors. Practitioners using Casky would identify findings showing: unauthorized modifications to environment configurations (TA0004 - privilege escalation via authorization bypass), unauthorized access to build secrets and deployment credentials (TA0006 - credential access through insufficient access controls), and cross-tenant procedure calls that bypass ownership validation. The platform's security skills would flag suspicious patterns such as applicationId manipulation in saveEnvironment, updateTraefikConfig, deploy, and stop procedures originating from authenticated sessions with inconsistent tenant ownership, revealing the authorization logic gaps that enable this multi-stage attack chain before exploitation occurs in production.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-116068.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-116068

Casky has 283 skills that investigate the attack patterns behind CVE-2026-116068. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn