CVE-2026-73087
Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher
Description
Dozzle is a realtime log viewer for docker containers. From 10.5.2 until 10.6.15, the isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, used by safeDialContext for webhook notification URLs, does not inspect IPv4 addresses embedded in 6to4, NAT64, Teredo, or IPv4-compatible IPv6 addresses, allowing an authenticated user to reach loopback or link-local targets that the guard intends to block. This issue is fixed in version 10.6.15.
INFO
Published Date :
Aug. 11, 2026, 5:19 p.m.
Last Modified :
Oct. 24, 2026, 3:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | LOW | [email protected] |
Solution
- Update Dozzle to version 10.6.15 or later.
- Verify SSRF guard is properly configured.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-73087.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-73087 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-73087
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-73087 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-73087 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 24, 2026
Action Type Old Value New Value Changed Translation Title: dozzle de amir20, Description: Dozzle es un visor de registros en tiempo real para contenedores docker. Desde la versión 10.5.2 hasta la 10.6.15, la protección SSRF isBlockedIP en internal/notification/dispatcher/webhook.go, utilizada por safeDialContext para las URL de notificación de webhook, no inspecciona las direcciones IPv4 incrustadas en direcciones 6to4, NAT64, Teredo o IPv6 compatibles con IPv4, lo que permite a un usuario autenticado alcanzar objetivos de loopback o de enlace local que la protección pretende bloquear. Este problema se solucionó en la versión 10.6.15. Title: dozzle de amir20, Description: Dozzle es un visor de registros en tiempo real para contenedores docker. Desde la versión 10.5.2 hasta la 10.6.15, la protección SSRF isBlockedIP en internal/notification/dispatcher/webhook.go, utilizada por safeDialContext para las URL de notificación de webhook, no inspecciona las direcciones IPv4 incrustadas en direcciones 6to4, NAT64, Teredo o IPv6 compatibles con IPv4, lo que permite a un usuario autenticado alcanzar objetivos de loopback o de enlace local que la protección pretende bloquear. Este problema se solucionó en la versión 10.6.15. -
CVE Translated by [email protected]
Oct. 23, 2026
Action Type Old Value New Value Added Translation Title: dozzle de amir20, Description: Dozzle es un visor de registros en tiempo real para contenedores docker. Desde la versión 10.5.2 hasta la 10.6.15, la protección SSRF isBlockedIP en internal/notification/dispatcher/webhook.go, utilizada por safeDialContext para las URL de notificación de webhook, no inspecciona las direcciones IPv4 incrustadas en direcciones 6to4, NAT64, Teredo o IPv6 compatibles con IPv4, lo que permite a un usuario autenticado alcanzar objetivos de loopback o de enlace local que la protección pretende bloquear. Este problema se solucionó en la versión 10.6.15. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 11, 2026
Action Type Old Value New Value Added Reference https://github.com/amir20/dozzle/security/advisories/GHSA-p2w3-6x73-2f6x Added SSVC {'id': 'CVE-2026-73087', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-11T19:56:42.946504Z'} -
New CVE Received by [email protected]
Aug. 11, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'amir20', 'product': 'dozzle', 'versions': [{'status': 'affected', 'version': '< 10.6.15'}]}] Added Description Dozzle is a realtime log viewer for docker containers. From 10.5.2 until 10.6.15, the isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, used by safeDialContext for webhook notification URLs, does not inspect IPv4 addresses embedded in 6to4, NAT64, Teredo, or IPv4-compatible IPv6 addresses, allowing an authenticated user to reach loopback or link-local targets that the guard intends to block. This issue is fixed in version 10.6.15. Added CVSS V4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-918 Added Reference https://github.com/amir20/dozzle/commit/8cf7ccd5ee041ecaea92b49951793d4d2393761f Added Reference https://github.com/amir20/dozzle/pull/4887 Added Reference https://github.com/amir20/dozzle/releases/tag/v10.6.15 Added Reference https://github.com/amir20/dozzle/security/advisories/GHSA-p2w3-6x73-2f6x