CVE-2025-53825 is a Critical severity missing authorization flaw (CVSS 9.4) in Dokploy, the self-hosted platform as a service. Before version 0.24.3, anyone could open a pull request on a public repository and trigger a preview deployment. Upgrade to 0.24.3 or later.
What's affected
The advisory says versions prior to 0.24.3 are affected, and that 0.24.3 contains the fix.
The problem is in the preview deployment feature, which builds a pull request automatically so reviewers can see a running copy. The advisory says that on a public repository an unauthenticated person could use it to run arbitrary code and read sensitive environment variables.
That puts every public Dokploy user with previews enabled at risk, in the words of the advisory. Instances that only deploy private repositories have a narrower exposure, but should still upgrade.
How to check if you're exposed
Check the version in the Dokploy dashboard, or read the image tag if you installed it with the standard container setup:
docker ps --format "table {{.Names}}\t{{.Image}}" | grep -i dokploy
If it is older than 0.24.3, plan the upgrade. Then check the applications in your instance. For each one, see whether it is connected to a public repository and whether preview deployments are enabled. Also review recent preview builds for pull requests from people you do not know, since those are the ones that deserve a second look.
What to do now
- Upgrade Dokploy to 0.24.3 or later.
- Turn off preview deployments for any application connected to a public repository until you have upgraded.
- Close and delete preview deployments created from pull requests by unknown authors.
- Rotate every secret that is available as an environment variable to those applications, since the advisory says they could be read.
- Keep production secrets out of preview environments, and give previews their own limited credentials.
Why it matters
The weakness is CWE-862, missing authorization. A pull request from a stranger is untrusted input, and building it is the same as running the stranger's code. A system that does that needs a gate that decides who may trigger a build, and the advisory says this gate was missing for public repositories.
The lesson reaches beyond this product. Anything that builds or runs code from a pull request needs a rule for who is allowed to start it, strict limits on what secrets it can read, and an approval step for first time contributors.
The record is not in the CISA Known Exploited Vulnerabilities catalogue. The advisory does not report attacks. The exposure of environment variables is the part to act on first, because stolen secrets stay useful long after the platform is patched.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is rotating secrets really needed?
If you ran previews on a public repository before 0.24.3, yes. The advisory says environment variables could be read, and a patch does not take back a secret that has already been exposed.
Are private repositories affected?
The advisory focuses on public repositories where anyone can open a pull request. Upgrade regardless, and review who can open pull requests on your private ones.
Sources
Last reviewed: 18 October 2026.
