CVE-2026-73087: Dozzle webhook SSRF guard bypass via IPv6 transition addresses

CVE-2026-73087 · Severity: medium · CVSS 4 · Published 2026-08-11

Dozzle is a log viewer and real-time monitoring tool used to inspect container and application logs. Its webhook notification feature includes a security guard to prevent authenticated users from using it as a proxy to reach sensitive internal services like cloud metadata endpoints or localhost APIs. However, the guard fails to recognize IPv6 transition mechanism addresses (6to4, NAT64, Teredo) that embed arbitrary IPv4 addresses, allowing an attacker to bypass this protection and reach previously blocked internal services.

Technologies: github.com/amir20/dozzle (Go). Vendors: Go.

Quick answers

Is CVE-2026-73087 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-73087 being exploited in the wild.
How severe is CVE-2026-73087?
Medium severity, with a CVSS score of 4, published 11 August 2026.
Which products and versions are affected?
github.com/amir20/dozzle (Go) < 1.29.1-0.20260804193351-8cf7ccd5ee04, SEMVER:introduced=0,fixed=1.29.1-0.20260804193351-8cf7ccd5ee04.
Is there a fix for CVE-2026-73087?
Yes. github.com/amir20/dozzle (Go): upgrade to 1.29.1-0.20260804193351-8cf7ccd5ee04 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73087 attacked?
It is attacked over the network.
Am I affected by CVE-2026-73087?
Check whether you run github.com/amir20/dozzle (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/amir20/dozzle (Go): upgrade to 1.29.1-0.20260804193351-8cf7ccd5ee04 or later
    go get github.com/amir20/dozzle@v1.29.1-0.20260804193351-8cf7ccd5ee04

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) guard bypass in the webhook notification dispatcher (CWE-918). The isBlockedIP() function in internal/notification/dispatcher/webhook.go checks for loopback (127.0.0.0/8, ::1), link-local (169.254.0.0/16, fe80::/10), multicast, and unspecified addresses before establishing webhook connections. However, it fails to recognize IPv6 transition mechanism prefixes: 6to4 (2002::/16), NAT64 WKP (64:ff9b::/96), and Teredo (2001:0000::/32), which all embed arbitrary IPv4 addresses that bypass all existing checks. An authenticated user can configure a webhook URL using these transition addresses (e.g., http://[2002:7f00:0001::1]/ to reach 127.0.0.1 or http://[2002:a9fe:a9fe::1]/ to reach 169.254.169.254) and trigger notifications to reach loopback services or cloud metadata endpoints. The attack requires authentication but authentication is available to legitimate users, making this an insider threat. Patches are available in commit 8cf7ccd and later versions.

Affected products

  • Amir Salihefendic Dozzle < 1.29.1-0.20260804193351-8cf7ccd5ee04

Identifiers

  • CVE-2026-73087
  • GHSA-p2w3-6x73-2f6x
  • GO-2026-6440

Timeline

  • 2026-08-04: disclosed
  • 2026-08-04: patched: Fixed in commit 8cf7ccd5ee041ecaea92b49951793d4d2393761f
  • 2026-09-08: advisory: GHSA-p2w3-6x73-2f6x published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.