CVE-2026-45298

8.6 HIGH

Dozzle is a realtime log viewer for docker containers

Published: 2026-05-26 · Last updated: 2026-05-29

Severity and scoring

CVSS: 8.6 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CWE: CWE-918

Affected products

Vendor	Product
amirraminfar	dozzle

Description

Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy (the documented quickstart, no DOZZLE_AUTH_PROVIDER set), POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-controlled URL into a WebhookDispatcher that sends an HTTP POST to the supplied URL with attacker-controlled request headers, and returns the response status code AND up to 1MB of the response body to the caller, when the target replies non-2xx. This vulnerability is fixed in 10.5.2.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-45298
[Other]https://github.com/amir20/dozzle/releases/tag/v10.5.2
[Vendor advisory]https://github.com/amir20/dozzle/security/advisories/GHSA-3v9w-6365-9w54
[Vendor advisory]https://github.com/amir20/dozzle/security/advisories/GHSA-3v9w-6365-9w54

Related CVEs

Same vendor

CVE-2026-44985 — Dozzle is a realtime log viewer for docker containers (9.6 CRITICAL)

Same CWE

CVE-2026-50131 — Fedify is a TypeScript library for building federated server apps powered by ActivityPub (8.6 HIGH)
CVE-2026-50127 — Weblate is a web based localization tool (5.9 MEDIUM)
CVE-2026-46683 — Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page
CVE-2026-20252 — In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.4.2604.3, 10.3.2512.1... (7.6 HIGH)
CVE-2026-48858 — Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvali...