Executive brief
Dozzle, a popular real-time log viewer for Docker containers, contains a security flaw in its interactive shell and container attachment features. An attacker can trick a logged-in user into visiting a malicious website that silently hijacks the user's session to gain full command-line access to the managed Docker containers. This could allow an unauthorized person to steal sensitive data, modify system configurations, or potentially take control of the underlying server.
Technical details
Dozzle's WebSocket upgrader for the /exec and /attach endpoints is configured with a custom CheckOrigin function that unconditionally returns true, disabling the default cross-origin protections provided by the gorilla/websocket library. Additionally, Dozzle uses JWT-based authentication stored in cookies with the 'SameSite: Lax' attribute. Because 'SameSite' only restricts cross-site requests (different eTLD+1) and not cross-origin requests within the same site (e.g., sibling subdomains or different ports on localhost), an attacker hosting a malicious page on a related origin can initiate a WebSocket connection. The browser will automatically include the victim's JWT cookie, granting the attacker authenticated interactive shell access to any container the victim is authorized to manage. This vulnerability is present even when authentication is enabled and properly configured.
Affected products
- amir20 Dozzle <= 10.5.1
Timeline
- 2026-05-06: disclosed: Advisory published by amir20/dozzle
- 2026-05-11: advisory: GitHub Advisory GHSA-j643-x8pv-8m67 published
- 2026-05-26: advisory: NVD published CVE-2026-44985