SSRF Vulnerability in Dozzle Realtime Log Viewer for Docker Containers
CVE-2026-73087

2.3LOW

Key Information:

Vendor

Amir20

Status
Dozzle
Vendor
CVE Published:
11 August 2026

What is CVE-2026-73087?

Dozzle, the real-time log viewer for Docker containers, is impacted by a Server-Side Request Forgery (SSRF) vulnerability. This issue arises in versions 10.5.2 through 10.6.15 due to insufficient validation of IP addresses in the isBlockedIP guard within the webhook notification system. As a result, an authenticated user may exploit this to access loopback or link-local addresses that should be protected, bypassing security measures intended to mitigate unauthorized access to sensitive resources. The vulnerability has been resolved in version 10.6.15.

Affected Version(s)

dozzle < 10.6.15

References

https://github.com/amir20/dozzle/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/amir20/dozzle/pull/4887
x_refsource_MISC
https://github.com/amir20/dozzle/commit/8cf7ccd5ee041ecae...
x_refsource_MISC

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.