CVE-2026-44985 Details
Description
Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, he WebSocket upgrader for the /exec and /attach endpoints uses CheckOrigin: func(r *http.Request) bool { return true }, accepting upgrade requests from any origin. Combined with the JWT cookie using SameSite: Lax, this enables Cross-Site WebSocket Hijacking (CSWSH). An attacker hosting a page on a same-site origin (e.g., a sibling subdomain, or another service on localhost) can initiate a WebSocket connection to the exec endpoint that carries the victim's valid JWT cookie, gaining interactive shell access in any container the victim is authorized to access. This vulnerability is fixed in 10.5.2.
A Cross-Site WebSocket Hijacking (CSWSH) vulnerability has been identified in Dozzle, a real-time log viewer for Docker containers, in versions prior to 10.5.2. The issue arises because the WebSocket upgrader for the '/exec' and '/attach' endpoints accepts upgrade requests from any origin. This vulnerability is compounded by the JWT cookie being set with 'SameSite: Lax', allowing an attacker to initiate a WebSocket connection to the exec endpoint with the victim's JWT cookie, thereby gaining interactive shell access to containers the victim can access.
Users can update to Dozzle version 10.5.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/amir20/dozzle/security/advisories/GHSA-j643-x8pv-8m67 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/amir20/dozzle/releases/tag/v10.5.2 | [email protected] | ProductRelease Notes |
| https://github.com/amir20/dozzle/security/advisories/GHSA-j643-x8pv-8m67 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| amirraminfar dozzle | < 10.5.2 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 29, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | New CVE Received | [email protected] |