Skip to content
OpenAdvisories

Package · Go

github.com/amir20/dozzle

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Medium 4.3
    CVE-2026-62286

    Dozzle label filters do not restrict container event and statistics streams

    Dozzle is a realtime log viewer for docker containers. Prior to 10.6.7, streamEvents in internal/web/events.go applies a restricted user's label filter to container lists but not to the container-stat and container-event channels returned by GET /api/events/s…

    amir20 dozzle github.com/amir20/dozzle Go
  • Low 2.3
    CVE-2026-73087

    Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher

    Dozzle is a realtime log viewer for docker containers. From 10.5.2 until 10.6.15, the isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, used by safeDialContext for webhook notification URLs, does not inspect IPv4 addresses embedded in 6to…

    amir20 dozzle github.com/amir20/dozzle Go
  • High 8.6
    CVE-2026-45298

    Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)

    Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy (the documented quickstart, no DOZZLE_AUTH_PROVIDER set), POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-cont…

    amir20 dozzle github.com/amir20/dozzle Go
  • High 8.7
    CVE-2026-44985

    Dozzle: Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpoints bypasses authentication

    Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, he WebSocket upgrader for the /exec and /attach endpoints uses CheckOrigin: func(r *http.Request) bool { return true }, accepting upgrade requests from any origin. Combined with the JWT c…

    amir20 dozzle github.com/amir20/dozzle Go
  • High 8.7
    CVE-2026-24740

    Dozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Access

    Dozzle is a realtime log viewer for docker containers. Prior to version 9.0.3, a flaw in Dozzle’s agent-backed shell endpoints allows a user restricted by label filters (for example, `label=env=dev`) to obtain an interactive root shell in out‑of‑scope contain…

    amir20 dozzle github.com/amir20/dozzle Go
  • Medium 4.8
    CVE-2024-47182

    Dozzle uses unsafe hash for passwords

    Dozzle is a realtime log viewer for docker containers. Before version 8.5.3, the app uses sha-256 as the hash for passwords, which leaves users susceptible to rainbow table attacks. The app switches to bcrypt, a more appropriate hash for passwords, in version…

    amir20 dozzle github.com/amir20/dozzle Go