What is CVE-2026-24740?

CVE-2026-24740 is a critical-severity vulnerability in Amir20 Dozzle, classified under Improper Access Control. CVSS score: 9.9/10. Published 2026-01-27.

How severe is CVE-2026-24740?

Critical severity. CVSS v3 base score is 9.9 out of 10.

Auth bypass in Amir20 Dozzle

CVE-2026-24740

Dozzle is a realtime log viewer for docker containers. Prior to version 9.0.3, a flaw in Dozzle’s agent-backed shell endpoints allows a user restricted by label filters (for example, `label=env=dev`) to obtain an interactive root shell in out‑of‑scope containers (for example, `env=prod`) on the same agent host by directly targeting their container IDs. Version 9.0.3 contains a patch for the issue.

Published 2026-01-27 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L.

EPSS exploit prediction

EPSS: 0.004 (34.1th percentile), scored 2026-09-24.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 34th percentile — 34.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: +0.000

Affected products

Amir20 Dozzle — versions < 9.0.3
Amirraminfar Dozzle

Weakness classification (CWE)

References

github.com/amir20/dozzle/security/advisories/GHSA-m855-r557-5rc5 (Exploit, Mitigation, Vendor Advisory)
github.com/amir20/dozzle/commit/620e59aa246347ba8a27e68c532853b8a5137bc1 (Patch)
github.com/amir20/dozzle/releases/tag/v9.0.3 (Product, Release Notes)

Frequently asked questions

What is CVE-2026-24740?: CVE-2026-24740 is a critical-severity vulnerability in Amir20 Dozzle, classified under Improper Access Control. CVSS score: 9.9/10. Published 2026-01-27.
How severe is CVE-2026-24740?: Critical severity. CVSS v3 base score is 9.9 out of 10.