Vulnerability in Amir20 Dozzle
CVE-2026-44985
Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, he WebSocket upgrader for the /exec and /attach endpoints uses CheckOrigin: func(r *http.Request) bool { return true }, accepting upgrade requests from any origin. Combined with the JWT cookie using SameSite: Lax, this enables Cross-Site WebSocket Hijacking (CSWSH). An attacker hosting a page on a same-site origin (e.g., a sibling subdomain, or another service on localhost) can initiate a WebSocket connection to the exec endpoint that carries the victim's valid JWT cookie, gaining interactive shell access in any container the victim is authorized to access. This vulnerability is fixed in 10.5.2.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (9.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 10th percentile — 9.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Amir20 Dozzle — versions < 10.5.2
- Amirraminfar Dozzle
Weakness classification (CWE)
References
- github.com/amir20/dozzle/releases/tag/v10.5.2 (Product, Release Notes)
- github.com/amir20/dozzle/security/advisories/GHSA-j643-x8pv-8m67 (Exploit, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-44985?
- CVE-2026-44985 is a critical-severity vulnerability in Amir20 Dozzle, classified under Origin Validation Error. CVSS score: 9.6/10. Published 2026-05-26.
- How severe is CVE-2026-44985?
- Critical severity. CVSS v3 base score is 9.6 out of 10.