Executive brief
Dozzle is a container monitoring and management dashboard that supports per-user access controls via label filters to separate multi-tenant deployments. A vulnerability in the events stream allows authenticated users to bypass their assigned label filters and receive real-time container telemetry (CPU, memory, network usage) and lifecycle metadata (container names, images, labels) for all containers, including those they are explicitly denied access to. This defeats the documented access-control boundary and exposes sensitive tenant/project information across isolation boundaries.
Technical details
The vulnerability is an access-control bypass in the `streamEvents` handler (`internal/web/events.go`) of Dozzle's event streaming API. While the initial container list and incremental `containers-changed` updates correctly apply the caller's `userLabels` filter, the `container-stat` (per-container CPU, memory, network, and disk metrics) and `container-event` (lifecycle: start/die/destroy/rename/pause/unpause) channels are forwarded unconditionally to every authenticated client without label comparison. The upstream `SubscribeEventsAndStats` subscription receives no filter argument and fans out unfiltered events/stats across all Docker clients. An attacker needs only valid credentials for any account and can open the normal SSE stream to enumerate every container on every monitored host, including identity (name, image), labels, and live telemetry — crossing the exact isolation boundary the filter feature is documented to enforce. The flaw applies to local Docker hosts and requires no special roles (not gated behind shell/actions/download permissions).
Affected products
- Dozzle Dozzle v10.6.5 and likely earlier versions
Timeline
- 2026-09-24: disclosed: Advisory published as GHSA-xcw9-qmmf-vqxj
- 2026-09-24: other: CVE-2026-62286 assigned