Skip to content

Preview Deployments are vulnerable to Remote Code Execution

Critical
Siumauricio published GHSA-h67g-mpq5-6ph5 Jul 14, 2025

Package

docker dokploy/dokploy (Docker)

Affected versions

< 0.24.3

Patched versions

>= 0.24.3

Description

Summary

An unauthenticated preview deployment vulnerability in Dokploy allows any user to execute arbitrary code and access sensitive environment variables by simply opening a pull request on a public repository. This exposes secrets and potentially enables remote code execution, putting all public Dokploy users using these preview deployments at risk.

Details

  • Anyone can fork a public repository using Dokploy, open a pull request with malicious code (e.g., code that leaks environment variables), and Dokploy will deploy it automatically.
  • The deployment will have access to the repository’s preview environment variables, which may include sensitive API keys or secrets.
  • The public deployment link is posted on the pull request, making it trivial for an attacker to access the output.

PoC

  • Create a public GitHub repository and connect it to Dokploy with preview deployments enabled.
  • Add environment variables (e.g., fake API keys) to the preview deployment configuration.
  • Fork the repository from another GitHub account.
  • Open a pull request with code that exposes environment variables, such as a Next.js API route that returns process.env.
  • Wait for Dokploy to deploy the pull request automatically and comment a public link.
  • Visit the deployment link to view the exposed environment variables.

Impact

All users of Dokploy preview deployments on public repositories (GitHub, possibly other git providers)

Severity

Critical

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

CVE ID

CVE-2025-53825

Weaknesses

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Learn more on MITRE.

Credits