Dokploy WebSocket Terminal Auth Bypass Vulnerability Analysis (CVE-2025-72006)

WebSocket Terminal Authentication Bypass Vulnerability Summary Vulnerability Overview Vulnerability Name: WebSocket Terminal Auth Bypass CVE ID: CVE-2025-72006 CVSS Score: 8.8 / 10 Severity: High Description: Dokploy’s WebSocket terminal processor uses as a special value to bypass organizational-level permission checks, allowing any authenticated user (regardless of organizational membership) to obtain an interactive root shell on the host server. Scope of Impact Affected Versions: <0.29.5 Fixed Version: None Attack Vector: Any valid user session cookie (any organization, any role) Entry Point: WebSocket connection to with a valid Cookie header Target: Host server — unrestricted root shell access Impact: An attacker can read all databases, environment variables, Docker API, and the file system Remediation Recommended Fixes: - Add a permission check when , ensuring that only administrators can access it. - When is not , verify that the user belongs to the organization and validate their permissions. Workarounds: - Restrict user registration to trusted users only. - Deploy behind a reverse proxy (such as Nginx or Traefik) to block WebSocket connections to unless they originate from a specific IP range. - Implement JWT-based authentication at the reverse proxy level. - Disable the WebSocket terminal feature by omitting the terminal service from the Docker Compose configuration. Proof of Concept (PoC) Code Step 1: E2E — WebSocket Connection Test Step 2: Actual Server Response Step 3: Unauthenticated Test Step 4: Code Path Analysis Step 5: Code Path Verification Why It Works only confirms that the session cookie is cryptographically valid. There are no calls to or organization membership queries. is a special value that bypasses the normal server lookup path — it connects directly to the host's Docker socket or local SSH daemon. Any user in any organization (even one that has been removed from the organization but still retains a valid session) can connect. Impact Attack Scenarios: 1. An attacker registers on the Dokploy instance (self-registration is allowed in most deployments). 2. The attacker connects to using their session cookie. 3. The server provides an interactive SSH shell running as root on the host. 4. The attacker can read all environment variables (registry passwords, API keys, DB credentials), read all databases, access the Docker API, install persistence mechanisms, and pivot to the internal network. Likelihood: - Exploitability: Easy — standard WebSocket connection with a valid session — requires no special configuration. - Prevalence: High — all self-hosted Dokploy instances are affected. - Detectability: Difficult — WebSocket traffic is not logged in access logs, and connections appear as normal terminal usage. - Overall: High — any authenticated user can obtain a root shell — resulting in complete host compromise. Workarounds Restrict user registration to trusted users only. Deploy behind a reverse proxy (such as Nginx or Traefik) to block WebSocket connections to unless they originate from a specific IP range. Implement JWT-based authentication at the reverse proxy level. Disable the WebSocket terminal feature by omitting the terminal service from the Docker Compose configuration.

Goal Reached Thanks to every supporter — we hit 100%!

Dokploy WebSocket Terminal Auth Bypass Vulnerability Analysis (CVE-2025-72006)

More from this source