CVE-2026-129433 is a CVSS 9.9 authenticated RCE in Dokploy, the self-hosted Docker deployment platform.

Vector: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

The PR:L requires an account. The S:C scope change crosses from the web app to the Docker host. The result is root on the host — every container, every env var, every secret the team deployed.

Why PR:L is thin on a team platform: Dokploy's access model is an org member list. The precondition is the product's normal usage.

What to do:

  1. Upgrade to the fixed release (confirm versions from the Dokploy advisory)
  2. Audit the org member list — remove stale accounts, shared logins; enable MFA
  3. Treat the Docker host as tier zero — segment it, monitor it
  4. If exposed on a vulnerable version: rotate all secrets reachable from the host

The access control for this CVE is the member list. The audit is part of the fix the patch doesn't perform.

Full write-up: https://threataft.com/articles/cve-2026-129433-dokploy-authenticated-rce-docker