Vulnerability Overview
CVE ID: CVE-2026-24740
Affected Product: Dozzle (Container Log Viewer with Shell/Exec capability)
Affected Versions: All versions below 9.0.3
Fixed Version: 9.0.3
Severity: High
CVSS Score: 8.7 (High)
Vulnerability Type: Container Isolation Bypass / Improper Access Control
Attack Vector: Network
Authentication Required: Yes (Low-privileged authenticated user)
User Interaction: Not required
Exploit Availability: Proof-of-concept exists for educational/research use only
Official Patch / Upgrade Link: Link provided below
Executive Summary
A high-severity authorization flaw was identified in Dozzle that allows authenticated, low-privileged users to gain unauthorized shell access to containers they are not permitted to interact with. The issue occurs due to improper enforcement of label-based access controls when containers are accessed directly by container ID.
As a result, a user who is intentionally restricted to a specific environment (for example, development) can bypass those restrictions and obtain a root shell in containers belonging to other environments (such as production), as long as the container ID is known or guessed.
This vulnerability directly impacts multi-tenant environments and shared container hosts where Dozzle is used for centralized container monitoring and management.
Technical Description
In affected versions of Dozzle, access control is designed around label-based filtering. Users are assigned filters (for example, label=env=dev) that determine which containers they are allowed to view and interact with. These filters are properly enforced when containers are listed in the user interface.
However, when a container is accessed directly by its container ID, a separate internal code path is used. In this path:
- User label filters are not passed to the container lookup logic.
- The container is resolved purely by its ID.
- Authorization checks that should validate label ownership are silently skipped.
Because of this logic gap, a low-privileged user with shell permissions can directly target any container running on the same Dozzle agent host, regardless of environment or ownership.
Attack Scenario
The vulnerability can be exploited in the following manner:
- A user is authenticated to Dozzle with limited permissions and a restrictive label filter (e.g.,
env=dev). - The user cannot see production containers in the UI.
- The user obtains or guesses a container ID belonging to another environment (such as production).
- A direct request is made to the Dozzle shell/exec endpoint using that container ID.
- Dozzle fails to validate the container against the user’s label filter.
- An interactive root shell is opened inside the unauthorized container.
This attack does not require administrative privileges and does not require user interaction beyond authentication.
Impact Assessment
If successfully exploited, the following impacts are possible:
- Unauthorized command execution inside containers
- Exposure of application secrets, credentials, and environment variables
- Data manipulation or destruction inside sensitive containers
- Lateral movement to other containers or services
- Potential escalation toward host-level compromise if additional weaknesses exist
In environments where production and non-production workloads share the same container host, this issue represents a critical trust boundary failure.
Proof of Concept Status
A working proof-of-concept has been demonstrated publicly that results in a root shell inside an unauthorized container.
No weaponization is required beyond direct API or WebSocket interaction with the vulnerable endpoint.
Detection & Monitoring Guidance
What to Look For
Detection should focus on identifying unauthorized container exec or attach operations, especially where:
- The user’s assigned label filter does not match the container labels
- Shell or exec actions occur on containers that were never listed for that user
- Interactive shell sessions are initiated by non-admin users
Relevant Log Sources
- Dozzle application logs
- Reverse proxy / web server access logs (Nginx, Traefik, etc.)
- Docker daemon or container runtime logs
- Host audit logs (process execution by Dozzle agent)
Suspicious Indicators
- Requests to
/api/hosts/*/containers/*/exec - Requests to
/api/hosts/*/containers/*/attach - WebSocket connections initiated by low-privileged users
- Docker
exec_createorexec_startevents on unexpected containers - Root-level commands executed without corresponding UI access
Splunk Detection Queries
1. Detect Container Exec or Attach Requests
index=dozzle_logs
("/api/hosts/" AND "/containers/" AND ("exec" OR "attach"))
| stats count by _time, user, src_ip, uri
2. Identify Exec Actions by Non-Admin Users
index=dozzle_logs
("/exec" OR "/attach")
| where user_role!="admin"
| table _time user user_role src_ip uri
3. Correlate Exec Events with Docker Runtime Logs
index=docker_logs ("exec_create" OR "exec_start")
| stats count by container_id, user, host
4. Detect Environment Label Mismatch
index=dozzle_logs "/exec"
| join container_id [
search index=docker_metadata
| fields container_id container_labels
]
| where NOT like(container_labels, "%" . user_allowed_label . "%")
5. Alert on Repeated Exec Attempts
index=dozzle_logs "/exec"
| stats count by user, src_ip
| where count > 3
MITRE ATT&CK Mapping
- T1059 – Command and Scripting Interpreter
- T1068 – Privilege Escalation
- T1087 – Account Discovery
- T1098 – Account Manipulation
- T1611 – Escape to Host
Remediation and Mitigation
Primary Fix
All affected deployments must be upgraded to Dozzle version 9.0.3 or later.
👉 Official upgrade link:
https://github.com/amir20/dozzle/releases/tag/v9.0.3
Temporary Mitigations
- Disable shell/exec functionality entirely
- Restrict network access to Dozzle APIs
- Limit Dozzle access to trusted administrative users only
- Review and minimize shell permissions in user configurations
- Monitor logs aggressively for suspicious exec behavior
Risk Rating Summary
| Factor | Rating |
|---|---|
| Exploit Complexity | Low |
| Privileges Required | Low |
| Impact | High |
| Likelihood | Medium–High |
| Overall Risk | High |
Final Takeaway
CVE-2026-24740 represents a serious authorization flaw that breaks container isolation guarantees in Dozzle. Any organization using Dozzle in multi-environment or multi-tenant setups should treat this issue as urgent. Immediate upgrading and retrospective log analysis are strongly recommended to reduce exposure and identify potential misuse.
