What’s Vulnerable › Vulnerabilities

CVE-2026-24740: Dozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Access

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-27 · updated 2026-06-17
• Weakness: CWE-284

Description

Dozzle is a realtime log viewer for docker containers. Prior to version 9.0.3, a flaw in Dozzle’s agent-backed shell endpoints allows a user restricted by label filters (for example, `label=env=dev`) to obtain an interactive root shell in out‑of‑scope containers (for example, `env=prod`) on the same agent host by directly targeting their container IDs. Version 9.0.3 contains a patch for the issue.

Affected products

• amir20 dozzle: before 9.0.3 — fixed in 9.0.3

How to fix

Upgrade to a fixed version: amir20 dozzle 9.0.3. Check the vendor advisory for mitigations.

References

• https://github.com/amir20/dozzle/commit/620e59aa246347ba8a27e68c532853b8a5137bc1
• https://github.com/amir20/dozzle/releases/tag/v9.0.3
• https://github.com/amir20/dozzle/security/advisories/GHSA-m855-r557-5rc5

Get alerted when CVE-2026-24740 or the next vulnerability affects your stack