# CVE-2026-45298: Dozzle SSRF in webhook testing endpoint

Source: https://junglewise.ai/threats/cve-2026-45298-dozzle-ssrf-in-webhook-testing-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-45298 · Severity: high · CVSS 8.6 · Published 2026-05-26

Dozzle, a real-time log viewer for Docker containers, contains a security flaw in its default configuration. In deployments where authentication is not explicitly enabled, an attacker can use the application to send unauthorized requests to internal network services. This could allow an attacker to scan private networks, access sensitive cloud metadata, or view internal administrative panels that are otherwise protected from the public internet.

Technologies: [github.com/amir20/dozzle (Go)](https://junglewise.ai/threats/technologies/github-com-amir20-dozzle). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-45298 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45298 being exploited in the wild.

**How severe is CVE-2026-45298?** High severity, with a CVSS score of 8.6, published 26 May 2026.

**Which products and versions are affected?** github.com/amir20/dozzle (Go) <= 8.14.12, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=8.14.12.

**Is there a fix for CVE-2026-45298?** A patch was published on 2026-05-05: Version 10.5.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45298 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-45298?** Check whether you run github.com/amir20/dozzle (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Dozzle's webhook testing endpoint. In default 'quickstart' deployments where no authentication provider is configured, the 'POST /api/notifications/test-webhook' endpoint is accessible without credentials. The 'WebhookDispatcher' fails to validate the user-supplied URL, allowing requests to loopback, link-local (IMDS), and private network addresses. Furthermore, the application reflects up to 1MB of the target's response body back to the attacker if the target returns a non-2xx status code, enabling data exfiltration from internal services. The vulnerability is addressed in version 10.5.2 by implementing IP/host validation and restricting access to the endpoint.

## Affected products

- amir20 Dozzle < 10.5.2

## Identifiers

- CVE-2026-45298
- GHSA-3v9w-6365-9w54
- GO-2026-5101

## Timeline

- 2026-05-05: patched: Version 10.5.2 released
- 2026-05-11: advisory: GitHub Security Advisory published
- 2026-05-26: disclosed: CVE published to NVD

## References

- [https://github.com/amir20/dozzle/releases/tag/v10.5.2](https://github.com/amir20/dozzle/releases/tag/v10.5.2)
- [https://github.com/amir20/dozzle/security/advisories/GHSA-3v9w-6365-9w54](https://github.com/amir20/dozzle/security/advisories/GHSA-3v9w-6365-9w54)

## Related threats

- [Dozzle label filter bypass in events stream](https://junglewise.ai/threats/cve-2026-62286-dozzle-label-filter-bypass-in-events-stream)
- [Dozzle webhook SSRF guard bypass via IPv6 transition addresses](https://junglewise.ai/threats/cve-2026-73087-dozzle-webhook-ssrf-guard-bypass-via-ipv6-transition-addresses)
- [Amir20 Dozzle Cross-Site WebSocket Hijacking in exec and attach endpoints](https://junglewise.ai/threats/cve-2026-44985-amir20-dozzle-cross-site-websocket-hijacking-in-exec-and-attach)
- [Dozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Access](https://junglewise.ai/threats/cve-2026-24740-dozzle-agent-label-based-access-control-bypass-allows)
- [GO-2024-3163 - Dozzle uses unsafe hash for passwords in github.com/amir20/dozzle](https://junglewise.ai/threats/cve-2024-47182-dozzle-uses-unsafe-hash-for-passwords)