Skip to content

dokploy

v0.29.13 Security

This release includes 16 security fixes for security teams reviewing exposed deployments.

Published 5d Deployment Automation
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 16 known CVEs

Topics

backend backup databases deployment devops docker
+8 more
frontend mariadb mongodb mysql nextjs postgresql self-hosted vps

Affected surfaces

auth rbac rce_ssrf

Summary

AI summary

Updates ui, fix, and compose across a mixed release.

Full changelog

What's Changed

  • fix: validate API key name length to prevent opaque 500 by @tanaymishra in https://github.com/Dokploy/dokploy/pull/4806
  • fix(compose): preserve named-volume access mode when adding suffix by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4823
  • fix(ui): disambiguate repos with the same name in the repository selector by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4826
  • fix(settings): allow clearing the server domain by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4825
  • fix(ui): typos by @EvanSchleret in https://github.com/Dokploy/dokploy/pull/4800
  • fix(security): OS command injection in git clone across all providers by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4855
  • fix(security): git provider credential disclosure via cross-org IDOR (.one endpoints) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4856
  • fix(security): SSH private key disclosure via server read endpoints by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4857
  • fix(security): cross-org IDOR + nodeId injection in swarm read endpoints by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4858
  • fix(security): git provider secret disclosure via application.one by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4859
  • fix(security): OS command injection in docker build/pull commands by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4860
  • fix(security): OS command injection via dockerImage in database service deploys by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4861
  • fix(security): OS command injection in database backup/restore commands by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4862
  • fix(security): OS command injection via compose path and custom command by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4863
  • fix(security): OS command injection via swarm nodeId and registry tag by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4864
  • fix(security): missing authorization on docker/terminal WebSocket handlers (member -> root) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4865
  • fix(security): host-schedule owner/admin bypass via applicationId (member → root) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4869
  • fix(security): missing authorization on GitHub App setup callback (unauth cross-org write) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4870
  • refactor(providers): inline quote() in git clone commands, drop shellWord helper by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4871
  • fix(security): escape user-controlled values across command-injection sinks (quote sweep) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4873
  • fix(security): command injection in registry.testRegistry / testRegistryById by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4875
  • fix(security): cross-org authorization bypass in server.remove by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4874
  • fix(ui): organization menu clipped when sidebar is collapsed by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4876
  • fix(2fa): show correct error message for invalid TOTP code by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4877
  • fix: rename compose "Reload" action to "Rebuild" by @ANSUJKMEHER in https://github.com/Dokploy/dokploy/pull/4847
  • fix(auth): enable email verification for SSO and user creation by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4880
  • feat(ai): allow organizations to define custom AI provider presets by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4882

New Contributors

  • @tanaymishra made their first contribution in https://github.com/Dokploy/dokploy/pull/4806
  • @EvanSchleret made their first contribution in https://github.com/Dokploy/dokploy/pull/4800
  • @ANSUJKMEHER made their first contribution in https://github.com/Dokploy/dokploy/pull/4847

Full Changelog: https://github.com/Dokploy/dokploy/compare/v0.29.12...v0.29.13

Security Fixes

  • fix(security): OS command injection in git clone across all providers
  • fix(security): git provider credential disclosure via cross-org IDOR (.one endpoints)
  • fix(security): SSH private key disclosure via server read endpoints
  • fix(security): cross-org IDOR + nodeId injection in swarm read endpoints
  • fix(security): git provider secret disclosure via application.one
  • fix(security): OS command injection in docker build/pull commands
  • fix(security): OS command injection via dockerImage in database service deploys
  • fix(security): OS command injection in database backup/restore commands
  • fix(security): OS command injection via compose path and custom command
  • fix(security): OS command injection via swarm nodeId and registry tag
  • fix(security): missing authorization on docker/terminal WebSocket handlers (member -> root)
  • fix(security): host-schedule owner/admin bypass via applicationId (member → root)
  • fix(security): missing authorization on GitHub App setup callback (unauth cross-org write)
  • fix(security): escape user-controlled values across command-injection sinks (quote sweep)
  • fix(security): command injection in registry.testRegistry / testRegistryById
  • fix(security): cross-org authorization bypass in server.remove
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track dokploy

Get notified when new releases ship.

Sign up free

About dokploy

Open Source Alternative to Vercel, Netlify and Heroku.

All releases →

Related context

Beta — feedback welcome: [email protected]