Junglewise Threat Intelligence

CVE-2026-73087: Dozzle webhook SSRF guard bypass via IPv6 transition addresses

CVE-2026-73087 · Severity: low · CVSS 2.3 · Published 2026-09-08

Executive brief

Dozzle is a log viewer and real-time monitoring tool used to inspect container and application logs. Its webhook notification feature includes a security guard to prevent authenticated users from using it as a proxy to reach sensitive internal services like cloud metadata endpoints or localhost APIs. However, the guard fails to recognize IPv6 transition mechanism addresses (6to4, NAT64, Teredo) that embed arbitrary IPv4 addresses, allowing an attacker to bypass this protection and reach previously blocked internal services.

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) guard bypass in the webhook notification dispatcher (CWE-918). The isBlockedIP() function in internal/notification/dispatcher/webhook.go checks for loopback (127.0.0.0/8, ::1), link-local (169.254.0.0/16, fe80::/10), multicast, and unspecified addresses before establishing webhook connections. However, it fails to recognize IPv6 transition mechanism prefixes: 6to4 (2002::/16), NAT64 WKP (64:ff9b::/96), and Teredo (2001:0000::/32), which all embed arbitrary IPv4 addresses that bypass all existing checks. An authenticated user can configure a webhook URL using these transition addresses (e.g., http://[2002:7f00:0001::1]/ to reach 127.0.0.1 or http://[2002:a9fe:a9fe::1]/ to reach 169.254.169.254) and trigger notifications to reach loopback services or cloud metadata endpoints. The attack requires authentication but authentication is available to legitimate users, making this an insider threat. Patches are available in commit 8cf7ccd and later versions.

Affected products

  • Amir Salihefendic Dozzle < 1.29.1-0.20260804193351-8cf7ccd5ee04

Timeline

  • 2026-08-04: disclosed
  • 2026-08-04: patched: Fixed in commit 8cf7ccd5ee041ecaea92b49951793d4d2393761f
  • 2026-09-08: advisory: GHSA-p2w3-6x73-2f6x published

References

Related threats