Read the docs
TI-2026-51294 Aliases CVE-2026-73087GHSA-p2w3-6x73-2f6x

Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher

Priority MEDIUM 45CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

Dozzle is a realtime log viewer for docker containers. From 10.5.2 until 10.6.15, the isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, used by safeDialContext for webhook notification URLs, does not inspect IPv4 addresses embedded in 6to4, NAT64, Teredo, or IPv4-compatible IPv6 addresses, allowing an authenticated user to reach loopback or link-local targets that the guard intends to block. This issue is fixed in version 10.6.15.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00465 40th percentileScored 2026-11-07
Fix Fixed dozzle (amir20): 10.6.15github.com/amir20/dozzle (Go): 1.29.1-0.20260804193351-8cf7ccd5ee04

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
amir20dozzlebefore 10.6.1510.6.15Patch availableCNA
—github.com/amir20/dozzle (Go)before 1.29.1-0.20260804193351-8cf7ccd5ee041.29.1-0.20260804193351-8cf7ccd5ee04Patch availableGHSA-p2w3-6x73-2f6x
  • dozzle Vendoramir20 Affected before 10.6.15 Fixed in 10.6.15 Patch available CNA
  • github.com/amir20/dozzle (Go) Vendor— Affected before 1.29.1-0.20260804193351-8cf7ccd5ee04 Fixed in 1.29.1-0.20260804193351-8cf7ccd5ee04 Patch available GHSA-p2w3-6x73-2f6x

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:amirraminfar:dozzle:*:*:*:*:*:*:*:*——amir20
  • cpe:2.3:a:amirraminfar:dozzle:*:*:*:*:*:*:*:* Versions — — ·amir20

Remediation

  • Fix · CNA dozzle (amir20) Fixed in 10.6.15
  • Fix · GHSA-p2w3-6x73-2f6x github.com/amir20/dozzle (Go) Fixed in 1.29.1-0.20260804193351-8cf7ccd5ee04 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-73087
  2. 2026-10-03 Alias added: GHSA-p2w3-6x73-2f6x

References

Advisory 1

Other 5

  • TI-2026-19945 Dozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Access CVSS 4.0HIGH 8.7
  • TI-2026-33098 Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy) CVSS 3.1HIGH 8.6
  • TI-2026-32844 Dozzle: Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpoints bypasses authentication CVSS 4.0HIGH 8.7
  • TI-2026-44477 Dozzle label filters do not restrict container event and statistics streams CVSS 3.1MEDIUM 4.3
  • TI-2024-31549 Dozzle uses unsafe hash for passwords CVSS 3.1HIGH 7.5
  • TI-2026-65354 Dozzle before 11.1.2 Path Traversal via Log ZIP Download CVSS 4.0MEDIUM 4.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences