Read the docs
TI-2026-44477 Aliases CVE-2026-62286GHSA-xcw9-qmmf-vqxj

Dozzle label filters do not restrict container event and statistics streams

Priority MEDIUM 53CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-285.

Summary

Dozzle is a realtime log viewer for docker containers. Prior to 10.6.7, streamEvents in internal/web/events.go applies a restricted user's label filter to container lists but not to the container-stat and container-event channels returned by GET /api/events/stream. In a simple-auth deployment using per-user filters, any authenticated restricted account can receive resource telemetry and lifecycle events for containers outside its authorized label scope. The exposed data includes container names, images, full label maps, CPU and memory use, network and disk totals, and deployment or restart activity across monitored hosts, but does not include log contents, environment values, or exec access. This issue is fixed in version 10.6.7.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00425 36th percentileScored 2026-11-07
Fix Fixed dozzle (amir20): 10.6.7github.com/amir20/dozzle (Go): 1.29.1-0.20260622172006-19c01e0fb491

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
amir20dozzlebefore 10.6.710.6.7Patch availableCNA
—github.com/amir20/dozzle (Go)before 1.29.1-0.20260622172006-19c01e0fb4911.29.1-0.20260622172006-19c01e0fb491Patch availableGHSA-xcw9-qmmf-vqxj
  • dozzle Vendoramir20 Affected before 10.6.7 Fixed in 10.6.7 Patch available CNA
  • github.com/amir20/dozzle (Go) Vendor— Affected before 1.29.1-0.20260622172006-19c01e0fb491 Fixed in 1.29.1-0.20260622172006-19c01e0fb491 Patch available GHSA-xcw9-qmmf-vqxj

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:amirraminfar:dozzle:*:*:*:*:*:*:*:*——amir20
  • cpe:2.3:a:amirraminfar:dozzle:*:*:*:*:*:*:*:* Versions — — ·amir20

Remediation

  • Fix · CNA dozzle (amir20) Fixed in 10.6.7
  • Fix · GHSA-xcw9-qmmf-vqxj github.com/amir20/dozzle (Go) Fixed in 1.29.1-0.20260622172006-19c01e0fb491 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-62286
  2. 2026-10-03 Alias added: GHSA-xcw9-qmmf-vqxj

References

Other 5

  • TI-2026-19945 Dozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Access CVSS 4.0HIGH 8.7
  • TI-2026-33098 Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy) CVSS 3.1HIGH 8.6
  • TI-2026-32844 Dozzle: Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpoints bypasses authentication CVSS 4.0HIGH 8.7
  • TI-2026-51294 Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher CVSS 4.0LOW 2.3
  • TI-2024-31549 Dozzle uses unsafe hash for passwords CVSS 3.1HIGH 7.5
  • TI-2026-65354 Dozzle before 11.1.2 Path Traversal via Log ZIP Download CVSS 4.0MEDIUM 4.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences