# github.com/amir20/dozzle (Go) vulnerabilities

6 known vulnerabilities (3 high, 2 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: v1.29.0 (Jun 23, 2020): affected by 6 advisories
- Newest unaffected release: Every release is affected by at least one advisory
- Releases: 173 since v1.0.1 (Oct 30, 2018)
- Registry: https://pkg.go.dev/github.com/amir20/dozzle
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-62286: v1.0.1 to v1.29.0 (through the newest release)
- CVE-2026-73087: v1.0.1 to v1.29.0 (through the newest release)
- CVE-2026-45298: v1.0.1 to v1.29.0 (through the newest release)
- CVE-2026-44985: v1.0.1 to v1.29.0 (through the newest release)
- CVE-2026-24740: v1.0.1 to v1.29.0 (through the newest release)
- CVE-2024-47182: v1.0.1 to v1.29.0 (through the newest release)

## Advisories (6)

### [CVE-2026-62286](https://cve.now/CVE-2026-62286): Dozzle label filters do not restrict container event and statistics streams

- Severity: Medium 4.3
- Published: Sep 24, 2026
- Affected: fixed in 1.29.1-0.20260622172006-19c01e0fb491.
- No fix released. The advisory names 1.29.1-0.20260622172006-19c01e0fb491 as the fix, which the registry doesn't have yet. The latest release, v1.29.0, is still affected.

### [CVE-2026-73087](https://cve.now/CVE-2026-73087): Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher

- Severity: Low 2.3
- Published: Aug 11, 2026
- Affected: fixed in 1.29.1-0.20260804193351-8cf7ccd5ee04.
- No fix released. The advisory names 1.29.1-0.20260804193351-8cf7ccd5ee04 as the fix, which the registry doesn't have yet. The latest release, v1.29.0, is still affected.

### [CVE-2026-45298](https://cve.now/CVE-2026-45298): Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)

- Severity: High 8.6
- Published: May 26, 2026
- Affected: through 8.14.12; all versions.
- No fix released. The latest release, v1.29.0, is still affected.

### [CVE-2026-44985](https://cve.now/CVE-2026-44985): Dozzle: Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpoints bypasses authentication

- Severity: High 8.7
- Published: May 26, 2026
- Affected: all versions; through 10.5.1.
- No fix released. The latest release, v1.29.0, is still affected.

### [CVE-2026-24740](https://cve.now/CVE-2026-24740): Dozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Access

- Severity: High 8.7
- Published: Jan 27, 2026
- Affected: fixed in 1.29.1-0.20260125230338-620e59aa2463.
- No fix released. The advisory names 1.29.1-0.20260125230338-620e59aa2463 as the fix, which the registry doesn't have yet. The latest release, v1.29.0, is still affected.

### [CVE-2024-47182](https://cve.now/CVE-2024-47182): Dozzle uses unsafe hash for passwords

- Severity: Medium 4.8
- Published: Sep 27, 2024
- Affected: all versions; fixed in 8.5.3.
- No fix released. The latest release, v1.29.0, is still affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/github.com/amir20/dozzle
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.