Executive brief
Dozzle, a real-time log viewer for Docker containers, contains a security flaw in its default configuration. In deployments where authentication is not explicitly enabled, an attacker can use the application to send unauthorized requests to internal network services. This could allow an attacker to scan private networks, access sensitive cloud metadata, or view internal administrative panels that are otherwise protected from the public internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Dozzle's webhook testing endpoint. In default 'quickstart' deployments where no authentication provider is configured, the 'POST /api/notifications/test-webhook' endpoint is accessible without credentials. The 'WebhookDispatcher' fails to validate the user-supplied URL, allowing requests to loopback, link-local (IMDS), and private network addresses. Furthermore, the application reflects up to 1MB of the target's response body back to the attacker if the target returns a non-2xx status code, enabling data exfiltration from internal services. The vulnerability is addressed in version 10.5.2 by implementing IP/host validation and restricting access to the endpoint.
Affected products
- amir20 Dozzle < 10.5.2
Timeline
- 2026-05-05: patched: Version 10.5.2 released
- 2026-05-11: advisory: GitHub Security Advisory published
- 2026-05-26: disclosed: CVE published to NVD