Security notice: AI provider API keys on Dokploy Cloud

We fixed a vulnerability in Dokploy Cloud that could have exposed AI provider API keys. Here's what we know, what we've done, and what we recommend you do.

Yesterday, November 12, 2026, a Dokploy Cloud user reported unauthorized usage of an AI provider API key they had configured in Dokploy. While looking into it, we found a vulnerability in Dokploy Cloud that could have exposed AI provider API keys. We want to share what we know so far, what we've done about it, and what we recommend you do.

Self-hosted instances should not be affected. This issue was specific to Dokploy Cloud, where many organizations share the same instance.

What happened

We identified a vulnerability that could have allowed a logged-in user to escalate their privileges and access AI provider API keys stored in other organizations on Dokploy Cloud. The vulnerability has been fixed. We haven't determined yet whether it is related to the reported unauthorized usage, and we're still reviewing other possible causes.

What we know so far

- We have not confirmed that any API keys were accessed. However, we can't rule it out.
- We have received couple reports of unauthorized API key usage, which we are investigating.
- We have not confirmed any unauthorized access to anything else, including customer servers and services.

What we've done
Fixed the privilege escalation vulnerability. Stopped returning saved API keys to the browser (October 15). Emailed every Dokploy Cloud organization owner with an AI provider configured.

What you should do
As a precaution, if you use AI providers on Dokploy Cloud:

1. Rotate your API keys. Create a new key in your provider's console, update it in Dokploy (Settings -> AI), and revoke the old one.2. Check your usage. Review your provider's usage dashboard for any activity you don't recognize.

If you're self-hosting Dokploy, we always recommend keeping your instance on the latest version.

Questions
If you noticed unusual usage or have any questions, reach out at [email protected] and we'll look into it with you.

We know you trust us with sensitive credentials, and we're sorry for the worry and trouble this may cause.

We'll keep you posted as we learn more.

The Dokploy Team