CVE-2026-45298: Dozzle SSRF in webhook testing endpoint

CVE-2026-45298 · Severity: high · CVSS 8.6 · Published 2026-05-26

Dozzle, a real-time log viewer for Docker containers, contains a security flaw in its default configuration. In deployments where authentication is not explicitly enabled, an attacker can use the application to send unauthorized requests to internal network services. This could allow an attacker to scan private networks, access sensitive cloud metadata, or view internal administrative panels that are otherwise protected from the public internet.

Technologies: github.com/amir20/dozzle (Go). Vendors: Go.

Quick answers

Is CVE-2026-45298 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45298 being exploited in the wild.
How severe is CVE-2026-45298?
High severity, with a CVSS score of 8.6, published 26 May 2026.
Which products and versions are affected?
github.com/amir20/dozzle (Go) <= 8.14.12, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=8.14.12.
Is there a fix for CVE-2026-45298?
A patch was published on 2026-05-05: Version 10.5.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45298 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45298?
Check whether you run github.com/amir20/dozzle (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Dozzle's webhook testing endpoint. In default 'quickstart' deployments where no authentication provider is configured, the 'POST /api/notifications/test-webhook' endpoint is accessible without credentials. The 'WebhookDispatcher' fails to validate the user-supplied URL, allowing requests to loopback, link-local (IMDS), and private network addresses. Furthermore, the application reflects up to 1MB of the target's response body back to the attacker if the target returns a non-2xx status code, enabling data exfiltration from internal services. The vulnerability is addressed in version 10.5.2 by implementing IP/host validation and restricting access to the endpoint.

Affected products

  • amir20 Dozzle < 10.5.2

Identifiers

  • CVE-2026-45298
  • GHSA-3v9w-6365-9w54
  • GO-2026-5101

Timeline

  • 2026-05-05: patched: Version 10.5.2 released
  • 2026-05-11: advisory: GitHub Security Advisory published
  • 2026-05-26: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.