What’s Vulnerable › Vulnerabilities

CVE-2026-44985: Dozzle: Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpoints bypasses authentication

• Severity: critical (CVSS 9.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-05-26 · updated 2026-07-24
• Weakness: CWE-346

Description

Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, he WebSocket upgrader for the /exec and /attach endpoints uses CheckOrigin: func(r *http.Request) bool { return true }, accepting upgrade requests from any origin. Combined with the JWT cookie using SameSite: Lax, this enables Cross-Site WebSocket Hijacking (CSWSH). An attacker hosting a page on a same-site origin (e.g., a sibling subdomain, or another service on localhost) can initiate a WebSocket connection to the exec endpoint that carries the victim's valid JWT cookie, gaining interactive shell access in any container the victim is authorized to access. This vulnerability is fixed in 10.5.2.

Affected products

• amir20 dozzle: before 10.5.2 — fixed in 10.5.2

How to fix

Upgrade to a fixed version: amir20 dozzle 10.5.2. Check the vendor advisory for mitigations.

References

• https://github.com/amir20/dozzle/releases/tag/v10.5.2
• https://github.com/amir20/dozzle/security/advisories/GHSA-j643-x8pv-8m67
• https://github.com/amir20/dozzle/security/advisories/GHSA-j643-x8pv-8m67

Get alerted when CVE-2026-44985 or the next vulnerability affects your stack