CVE-2026-73087

Dozzle is a realtime log viewer for docker containers. From 10.5.2 until 10.6.15, the isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, used by safeDialContext for webhook notification URLs, does not inspect IPv4 addresses embedded in 6to4, NAT64, Teredo, or IPv4-compatible IPv6 addresses, allowing an authenticated user to reach loopback or link-local targets that the guard intends to block. This issue is fixed in version 10.6.15.

CVSS

No CVSS.

References

Link	Resource
https://github.com/amir20/dozzle/commit/8cf7ccd5ee041ecaea92b49951793d4d2393761f
https://github.com/amir20/dozzle/pull/4887
https://github.com/amir20/dozzle/releases/tag/v10.6.15
https://github.com/amir20/dozzle/security/advisories/GHSA-p2w3-6x73-2f6x
https://github.com/amir20/dozzle/security/advisories/GHSA-p2w3-6x73-2f6x

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Dozzle es un visor de registros en tiempo real para contenedores docker. Desde la versión 10.5.2 hasta la 10.6.15, la protección SSRF isBlockedIP en internal/notification/dispatcher/webhook.go, utilizada por safeDialContext para las URL de notificación de webhook, no inspecciona las direcciones IPv4 incrustadas en direcciones 6to4, NAT64, Teredo o IPv6 compatibles con IPv4, lo que permite a un usuario autenticado alcanzar objetivos de loopback o de enlace local que la protección pretende bloquear. Este problema se solucionó en la versión 10.6.15.

Information

Published : 2026-08-11 17:19

Updated : 2026-10-24 15:10

NVD link : CVE-2026-73087

Mitre link : CVE-2026-73087

CVE.ORG link : CVE-2026-73087

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-73087", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73087", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T19:56:42.946504Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "amir20", "product": "dozzle", "versions": [{"status": "affected", "version": "< 10.6.15"}]}]}], "published": "2026-08-11T17:19:16.830", "references": [{"url": "https://github.com/amir20/dozzle/commit/8cf7ccd5ee041ecaea92b49951793d4d2393761f", "source": "security-advisories@github.com"}, {"url": "https://github.com/amir20/dozzle/pull/4887", "source": "security-advisories@github.com"}, {"url": "https://github.com/amir20/dozzle/releases/tag/v10.6.15", "source": "security-advisories@github.com"}, {"url": "https://github.com/amir20/dozzle/security/advisories/GHSA-p2w3-6x73-2f6x", "source": "security-advisories@github.com"}, {"url": "https://github.com/amir20/dozzle/security/advisories/GHSA-p2w3-6x73-2f6x", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Dozzle is a realtime log viewer for docker containers. From 10.5.2 until 10.6.15, the isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, used by safeDialContext for webhook notification URLs, does not inspect IPv4 addresses embedded in 6to4, NAT64, Teredo, or IPv4-compatible IPv6 addresses, allowing an authenticated user to reach loopback or link-local targets that the guard intends to block. This issue is fixed in version 10.6.15."}, {"lang": "es", "value": "Dozzle es un visor de registros en tiempo real para contenedores docker. Desde la versi\u00f3n 10.5.2 hasta la 10.6.15, la protecci\u00f3n SSRF isBlockedIP en internal/notification/dispatcher/webhook.go, utilizada por safeDialContext para las URL de notificaci\u00f3n de webhook, no inspecciona las direcciones IPv4 incrustadas en direcciones 6to4, NAT64, Teredo o IPv6 compatibles con IPv4, lo que permite a un usuario autenticado alcanzar objetivos de loopback o de enlace local que la protecci\u00f3n pretende bloquear. Este problema se solucion\u00f3 en la versi\u00f3n 10.6.15."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "security-advisories@github.com"}