1. Dokploy: cross-organisation application control (High)

CVE-2026-116068 (8.7)

Impact

The CVE record published today covers Dokploy through 0.30.10. An authenticated organisation owner or administrator can act on another tenant’s applications by supplying a foreign application identifier, potentially changing environment variables, deployment settings or availability.

Checks and IoCs

Review retained application/audit logs and configuration history for changes made by users outside the owning organisation, unexpected deployments and altered environment settings. These are investigation leads; the cited disclosures do not establish active exploitation or provide campaign-specific IPs or hashes.

Remediation

Verify that your deployed build contains the maintainer’s organisation-boundary fix, commit b3cd3c5. The cited CVE record does not identify a fixed tagged release, so do not assume that any particular later version is safe without checking. Until verified, avoid hosting mutually untrusted organisations on the affected control plane.

Sources: CVE record · Original report and maintainer resolution · Maintainer fix

2. Docker-Proxy: unauthenticated configuration access (Moderate)

CVE-2026-116070 (6.9)

Impact

Today’s record covers the third-party dqzboy/Docker-Proxy project through 5.1.9, not Docker Engine generally. Missing authentication in the hubcmdui configuration routes can expose notification credentials and allow configuration changes, including monitoring destinations.

Checks and IoCs

Review available web logs for unexpected access to /api/config, then compare current notification destinations, menu links and proxy settings with your approved configuration. Legitimate requests use this route too; a request alone does not prove compromise. No campaign-specific IoCs are established by the cited record.

Remediation

Deploy a maintainer build containing fix a173bef, which restricts sensitive configuration reads and requires authentication for writes. Confirm the deployed image includes it; the CVE record gives no fixed release number. Restrict or disable the affected management interface pending remediation. If credentials may have been exposed, rotate the affected bot tokens and webhook credentials.

Sources: CVE record · Maintainer authentication fix

3. rclone S3 serving: cross-tenant multipart uploads (Moderate)

CVE-2026-116187 (6.1)

Impact

The record published today assigns a CVE to an earlier rclone advisory affecting 1.68.0 through 1.75.1 when running serve s3 --auth-proxy for multiple tenants. An authenticated tenant who obtains another tenant’s bucket, object and upload identifier may interfere with in-flight multipart uploads and access associated metadata. This is not a general flaw in ordinary rclone copy operations.

Checks and remediation

Check the server’s version and launch configuration. The following command is read-only; run it in the environment hosting the service, including inside its container where applicable:

rclone version

Upgrade to 1.75.2 or a later fixed release. Review retained S3 request logs for multipart-upload operations inconsistent with tenant ownership. The cited sources do not provide campaign IoCs or establish active exploitation; missing or incomplete logs cannot rule out misuse.

Sources: New CVE record · Maintainer advisory and fixed version