Unauthorized Data Exposure in Dozzle Log Viewer for Docker Containers
CVE-2026-62286

4.3MEDIUM

Key Information:

Vendor

Amir20

Status
Dozzle
Vendor
CVE Published:
24 September 2026

What is CVE-2026-62286?

A vulnerability in Dozzle, a real-time log viewer for Docker containers, allows authenticated restricted users to access sensitive telemetry and lifecycle events for containers that exceed their authorized label scope. This issue arises when the streamEvents function does not adequately filter user labels for the container-stat and container-event channels. As a result, restricted users may view critical information, such as container names, memory usage, and deployment activities, raising cybersecurity concerns. The vulnerability has been addressed in version 10.6.7.

Affected Version(s)

dozzle < 10.6.7

References

https://github.com/amir20/dozzle/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/amir20/dozzle/pull/4803
x_refsource_MISC
https://github.com/amir20/dozzle/commit/19c01e0fb491c1707...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.