Is CVE-2026-111331 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111331 being exploited in the wild.

How severe is CVE-2026-111331?

Medium severity, with a CVSS score of 6.3, published 15 October 2026.

Is there a fix for CVE-2026-111331?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-111331 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-111331?

Check whether you run Dokploy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111331: Dokploy cross-organization authorization bypass in port router

CVE-2026-111331 · Severity: medium · CVSS 6.3 · Published 2026-10-15

Dokploy is an open-source platform for deploying and managing applications, similar to Vercel or Heroku. The vulnerability allows authenticated users with owner or admin roles in one organization to read, modify, or delete port configurations belonging to other organizations' applications, potentially disrupting how services are published online.

Technologies: Dokploy. Vendors: Dokploy.

Quick answers

Is CVE-2026-111331 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111331 being exploited in the wild.
How severe is CVE-2026-111331?: Medium severity, with a CVSS score of 6.3, published 15 October 2026.
Which products and versions are affected?: Dokploy through 0.30.8.
Is there a fix for CVE-2026-111331?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-111331 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-111331?: Check whether you run Dokploy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The port tRPC router in Dokploy through 0.30.8 performs service permission checks on the supplied applicationId but does not verify that the application belongs to the authenticated user's organization. Attackers with valid credentials can supply a portId or applicationId from a different organization to port.create, port.one, port.update, or port.delete operations to gain unauthorized access. The fix involves validating that the target application's organization matches the authenticated user's organization context.

Affected products

Dokploy Dokploy through 0.30.8

Timeline

2026-10-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.