# CVE-2026-62286: Dozzle label filter bypass in events stream

Source: https://junglewise.ai/threats/cve-2026-62286-dozzle-label-filter-bypass-in-events-stream  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-62286 · Severity: medium · CVSS 4.3 · Published 2026-09-24

Dozzle is a container monitoring and management dashboard that supports per-user access controls via label filters to separate multi-tenant deployments. A vulnerability in the events stream allows authenticated users to bypass their assigned label filters and receive real-time container telemetry (CPU, memory, network usage) and lifecycle metadata (container names, images, labels) for all containers, including those they are explicitly denied access to. This defeats the documented access-control boundary and exposes sensitive tenant/project information across isolation boundaries.

Technologies: [github.com/amir20/dozzle (Go)](https://junglewise.ai/threats/technologies/github-com-amir20-dozzle). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-62286 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62286 being exploited in the wild.

**How severe is CVE-2026-62286?** Medium severity, with a CVSS score of 4.3, published 24 September 2026.

**Which products and versions are affected?** github.com/amir20/dozzle (Go) < 1.29.1-0.20260622172006-19c01e0fb491, SEMVER:introduced=0,fixed=1.29.1-0.20260622172006-19c01e0fb491.

**Is there a fix for CVE-2026-62286?** Yes. github.com/amir20/dozzle (Go): upgrade to 1.29.1-0.20260622172006-19c01e0fb491 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62286 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-62286?** Check whether you run github.com/amir20/dozzle (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/amir20/dozzle (Go): upgrade to 1.29.1-0.20260622172006-19c01e0fb491 or later

  ```sh
  go get github.com/amir20/dozzle@v1.29.1-0.20260622172006-19c01e0fb491
  ```


## Technical details

The vulnerability is an access-control bypass in the `streamEvents` handler (`internal/web/events.go`) of Dozzle's event streaming API. While the initial container list and incremental `containers-changed` updates correctly apply the caller's `userLabels` filter, the `container-stat` (per-container CPU, memory, network, and disk metrics) and `container-event` (lifecycle: start/die/destroy/rename/pause/unpause) channels are forwarded unconditionally to every authenticated client without label comparison. The upstream `SubscribeEventsAndStats` subscription receives no filter argument and fans out unfiltered events/stats across all Docker clients. An attacker needs only valid credentials for any account and can open the normal SSE stream to enumerate every container on every monitored host, including identity (name, image), labels, and live telemetry — crossing the exact isolation boundary the filter feature is documented to enforce. The flaw applies to local Docker hosts and requires no special roles (not gated behind shell/actions/download permissions).

## Affected products

- Dozzle Dozzle v10.6.5 and likely earlier versions

## Identifiers

- CVE-2026-62286
- GHSA-xcw9-qmmf-vqxj
- GO-2026-6592

## Timeline

- 2026-09-24: disclosed: Advisory published as GHSA-xcw9-qmmf-vqxj
- 2026-09-24: other: CVE-2026-62286 assigned

## Related threats

- [Dozzle webhook SSRF guard bypass via IPv6 transition addresses](https://junglewise.ai/threats/cve-2026-73087-dozzle-webhook-ssrf-guard-bypass-via-ipv6-transition-addresses)
- [Dozzle SSRF in webhook testing endpoint](https://junglewise.ai/threats/cve-2026-45298-dozzle-ssrf-in-webhook-testing-endpoint)
- [Amir20 Dozzle Cross-Site WebSocket Hijacking in exec and attach endpoints](https://junglewise.ai/threats/cve-2026-44985-amir20-dozzle-cross-site-websocket-hijacking-in-exec-and-attach)
- [Dozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Access](https://junglewise.ai/threats/cve-2026-24740-dozzle-agent-label-based-access-control-bypass-allows)
- [GO-2024-3163 - Dozzle uses unsafe hash for passwords in github.com/amir20/dozzle](https://junglewise.ai/threats/cve-2024-47182-dozzle-uses-unsafe-hash-for-passwords)