Is CVE-2026-44985 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44985 being exploited in the wild.

How severe is CVE-2026-44985?

Critical severity, with a CVSS score of 9.6, published 26 May 2026.

Which products and versions are affected?

Amir Raminfar Dozzle <= 10.5.1; github.com/amir20/dozzle (Go) <= 10.5.1, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=10.5.1.

Is there a fix for CVE-2026-44985?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-44985 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44985?

Check whether you run Amir Raminfar Dozzle or github.com/amir20/dozzle (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44985: Amir20 Dozzle Cross-Site WebSocket Hijacking in exec and attach endpoints

Q: Is there a fix for CVE-2026-44985?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-44985 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-44985?

Check whether you run Amir Raminfar Dozzle or github.com/amir20/dozzle (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44985 · Severity: critical · CVSS 9.6 · Published 2026-05-26

Dozzle, a popular real-time log viewer for Docker containers, contains a security flaw in its interactive shell and container attachment features. An attacker can trick a logged-in user into visiting a malicious website that silently hijacks the user's session to gain full command-line access to the managed Docker containers. This could allow an unauthorized person to steal sensitive data, modify system configurations, or potentially take control of the underlying server.

Technologies: Amir Raminfar Dozzle, github.com/amir20/dozzle (Go). Vendors: Amir Raminfar, Go.

Quick answers

Is CVE-2026-44985 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44985 being exploited in the wild.
How severe is CVE-2026-44985?: Critical severity, with a CVSS score of 9.6, published 26 May 2026.
Which products and versions are affected?: Amir Raminfar Dozzle <= 10.5.1; github.com/amir20/dozzle (Go) <= 10.5.1, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=10.5.1.
Is there a fix for CVE-2026-44985?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44985 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44985?: Check whether you run Amir Raminfar Dozzle or github.com/amir20/dozzle (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Dozzle's WebSocket upgrader for the /exec and /attach endpoints is configured with a custom CheckOrigin function that unconditionally returns true, disabling the default cross-origin protections provided by the gorilla/websocket library. Additionally, Dozzle uses JWT-based authentication stored in cookies with the 'SameSite: Lax' attribute. Because 'SameSite' only restricts cross-site requests (different eTLD+1) and not cross-origin requests within the same site (e.g., sibling subdomains or different ports on localhost), an attacker hosting a malicious page on a related origin can initiate a WebSocket connection. The browser will automatically include the victim's JWT cookie, granting the attacker authenticated interactive shell access to any container the victim is authorized to manage. This vulnerability is present even when authentication is enabled and properly configured.

Affected products

amir20 Dozzle <= 10.5.1

Identifiers

CVE-2026-44985
GHSA-j643-x8pv-8m67
GO-2026-5449

Timeline

2026-05-06: disclosed: Advisory published by amir20/dozzle
2026-05-11: advisory: GitHub Advisory GHSA-j643-x8pv-8m67 published
2026-05-26: advisory: NVD published CVE-2026-44985

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.