CVE-2026-45632: Dokploy: Schedule Authorization Bypass Enables Host/Server Command Execution

Synopsis

Authorization bypass in Dokploy's schedule router (versions 0.26.7 and earlier) lets any authenticated user create, update, run, or delete schedules across organization boundaries by supplying a known scheduleId or serverId. Because schedules of type server and dokploy-server write and execute scripts on the host or a remote server, exploitation yields full remote code execution on the Dokploy host or any managed server. No upstream fix has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Dokploy API over the network where the schedule router is exposed.

• AuthenticationRequired

  Any low-privilege authenticated Dokploy account is sufficient; no admin role or cross-org membership is needed.

• Victim interactionNot required

  Exploitation is fully server-side and requires no action from any user in the target organization.

• Attack complexityDetail

  AC:L indicates the exploit is reliable once a valid scheduleId or serverId is known, with no race or environmental preconditions.

Blast Radius

• Executes arbitrary scripts on the Dokploy host or any managed remote server, yielding full RCE under the Dokploy service account.
• Reads, modifies, or deletes schedules and any data reachable from the compromised host, including secrets, deployment configs, and tenant workloads.
• Disrupts or destroys scheduled jobs and the services they manage across other organizations on the same Dokploy instance.
• Pivots across tenant boundaries because the scope-changed vector (S:C) means impact extends beyond the vulnerable component to every org sharing the host.