CVE-2026-45298 Details
Description
Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy (the documented quickstart, no DOZZLE_AUTH_PROVIDER set), POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-controlled URL into a WebhookDispatcher that sends an HTTP POST to the supplied URL with attacker-controlled request headers, and returns the response status code AND up to 1MB of the response body to the caller, when the target replies non-2xx. This vulnerability is fixed in 10.5.2.
A server-side request forgery (SSRF) vulnerability has been identified in Dozzle, a real-time log viewer for Docker containers, in versions prior to 10.5.2. In a default deployment without authentication, the 'POST /api/notifications/test-webhook' endpoint is accessible without any auth. This endpoint forwards an attacker-controlled URL to a WebhookDispatcher, which sends an HTTP POST request to the specified URL with user-defined headers. If the target URL responds with a non-2xx status, the response status code and up to 1MB of the response body are returned to the caller. This vulnerability allows for unauthorized access to internal services and metadata endpoints, according to the GitHub advisory.
Users are advised to update Dozzle to version 10.5.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/amir20/dozzle/security/advisories/GHSA-3v9w-6365-9w54 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/amir20/dozzle/releases/tag/v10.5.2 | [email protected] | ProductRelease Notes |
| https://github.com/amir20/dozzle/security/advisories/GHSA-3v9w-6365-9w54 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| amirraminfar dozzle | < 10.5.2 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 29, 2026 | Initial Analysis | [email protected] |
| May 27, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | New CVE Received | [email protected] |