Is CVE-2026-62286 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62286 being exploited in the wild.

How severe is CVE-2026-62286?

Medium severity, with a CVSS score of 4.3, published 24 September 2026.

Which products and versions are affected?

github.com/amir20/dozzle (Go) < 1.29.1-0.20260622172006-19c01e0fb491, SEMVER:introduced=0,fixed=1.29.1-0.20260622172006-19c01e0fb491.

Is there a fix for CVE-2026-62286?

Yes. github.com/amir20/dozzle (Go): upgrade to 1.29.1-0.20260622172006-19c01e0fb491 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62286 attacked?

It is attacked over the network.

Am I affected by CVE-2026-62286?

Check whether you run github.com/amir20/dozzle (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62286: Dozzle label filter bypass in events stream

Q: Is there a fix for CVE-2026-62286?

Yes. github.com/amir20/dozzle (Go): upgrade to 1.29.1-0.20260622172006-19c01e0fb491 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-62286 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-62286?

Check whether you run github.com/amir20/dozzle (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62286 · Severity: medium · CVSS 4.3 · Published 2026-09-24

Dozzle is a container monitoring and management dashboard that supports per-user access controls via label filters to separate multi-tenant deployments. A vulnerability in the events stream allows authenticated users to bypass their assigned label filters and receive real-time container telemetry (CPU, memory, network usage) and lifecycle metadata (container names, images, labels) for all containers, including those they are explicitly denied access to. This defeats the documented access-control boundary and exposes sensitive tenant/project information across isolation boundaries.

Technologies: github.com/amir20/dozzle (Go). Vendors: Go.

Quick answers

Is CVE-2026-62286 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62286 being exploited in the wild.
How severe is CVE-2026-62286?: Medium severity, with a CVSS score of 4.3, published 24 September 2026.
Which products and versions are affected?: github.com/amir20/dozzle (Go) < 1.29.1-0.20260622172006-19c01e0fb491, SEMVER:introduced=0,fixed=1.29.1-0.20260622172006-19c01e0fb491.
Is there a fix for CVE-2026-62286?: Yes. github.com/amir20/dozzle (Go): upgrade to 1.29.1-0.20260622172006-19c01e0fb491 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62286 attacked?: It is attacked over the network.
Am I affected by CVE-2026-62286?: Check whether you run github.com/amir20/dozzle (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/amir20/dozzle (Go): upgrade to 1.29.1-0.20260622172006-19c01e0fb491 or later
```
go get github.com/amir20/dozzle@v1.29.1-0.20260622172006-19c01e0fb491
```

Technical details

The vulnerability is an access-control bypass in the `streamEvents` handler (`internal/web/events.go`) of Dozzle's event streaming API. While the initial container list and incremental `containers-changed` updates correctly apply the caller's `userLabels` filter, the `container-stat` (per-container CPU, memory, network, and disk metrics) and `container-event` (lifecycle: start/die/destroy/rename/pause/unpause) channels are forwarded unconditionally to every authenticated client without label comparison. The upstream `SubscribeEventsAndStats` subscription receives no filter argument and fans out unfiltered events/stats across all Docker clients. An attacker needs only valid credentials for any account and can open the normal SSE stream to enumerate every container on every monitored host, including identity (name, image), labels, and live telemetry — crossing the exact isolation boundary the filter feature is documented to enforce. The flaw applies to local Docker hosts and requires no special roles (not gated behind shell/actions/download permissions).

Affected products

Dozzle Dozzle v10.6.5 and likely earlier versions

Identifiers

CVE-2026-62286
GHSA-xcw9-qmmf-vqxj
GO-2026-6592

Timeline

2026-09-24: disclosed: Advisory published as GHSA-xcw9-qmmf-vqxj
2026-09-24: other: CVE-2026-62286 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.