CVE-2026-62286

Executive Summary

CVE-2026-62286 is an information disclosure vulnerability in Dozzle, a realtime log viewer for Docker containers. Prior to version 10.6.7, the streamEvents handler in internal/web/events.go fails to apply per-user label filters to the container-stat and container-event channels exposed by GET /api/events/stream. In simple-auth deployments configured with per-user filters, any authenticated restricted account can receive resource telemetry and container lifecycle events for containers outside its authorized label scope. The impact is limited to confidentiality (CVSS 4.3) — logs, environment values, and exec access are not exposed — but the leak reveals container names, images, full label maps, CPU/memory metrics, network/disk totals, and restart or deployment activity across monitored hosts.

Technical Analysis

Dozzle supports label-based access control in simple-auth mode, where each user is assigned a filter restricting which containers they may observe. The vulnerability resides in the event-stream code path: streamEvents in internal/web/events.go. The description states that the function "applies a restricted user's label filter to container lists but not to the container-stat and container-event channels returned by GET /api/events/stream." In other words, the list-enumeration path enforces authorization, while the streaming telemetry path does not — an inconsistent enforcement of the same policy across two code paths serving the same resource.

This is a classic case of CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) manifesting as broken access control on a supplemental data channel. The endpoint GET /api/events/stream is reachable by any authenticated user (CVSS PR:L). Because the flaw is a missing filter check rather than an injection or memory-safety bug, exploitation requires no payload crafting — a restricted account simply subscribes to the stream and passively receives data the authorization model intends to withhold.

The exposed fields per the description are: container names, images, full label maps, CPU and memory use, network and disk totals, and deployment/restart activity across monitored hosts. Explicitly not exposed: log contents, environment values, and exec access. This bounds the severity — it is a telemetry and metadata leak, not a path to code execution or credential theft. The attack is network-reachable (AV:N), requires low privilege (PR:L), and no user interaction (UI:N), yielding a confidentiality-only impact (C:L) and an overall score of 4.3.

Exploitation Scenarios

No public PoC or exploit code exists for this CVE; the chain below is inferred from the vulnerability class (broken access control / inconsistent filter enforcement on an event stream) and the NVD description.

1. Reconnaissance / target identification. An attacker identifies a Dozzle instance running a version prior to 10.6.7 in a simple-auth deployment that uses per-user label filters. This is discoverable via Shodan using the Dozzle web UI fingerprint, or during authorized or unauthorized assessment of internal infrastructure.

2. Triggering the flaw. Using any authenticated restricted account — one whose label filter is intended to limit visibility to a subset of containers — the attacker issues a request to GET /api/events/stream and subscribes to the container-stat and container-event channels. Because streamEvents in internal/web/events.go applies the label filter to container lists but not to these channels, the filter is bypassed at the stream layer.

3. Data extraction. The attacker passively collects the streamed data: container names, images, full label maps, CPU and memory usage, network and disk totals, and deployment/restart events for containers outside the authorized label scope, including across monitored hosts. No exploitation payload is required beyond an authenticated stream subscription.

4. Post-exploitation impact. The leaked metadata enables discovery of infrastructure topology, application inventory (images), deployment cadence, and resource-usage patterns for systems the account was never authorized to observe. This data supports lateral-movement planning and targeting. The description explicitly limits the impact: log contents, environment values, and exec access are not exposed, so the flaw is a reconnaissance and situational-awareness enabler rather than a direct compromise vector.

Impact Assessment

The business impact is information disclosure confined to resource telemetry and container lifecycle metadata. Affected systems are Dozzle deployments below 10.6.7 configured with simple auth and per-user label filters. The blast radius is bounded by the telemetry stream rather than by container contents: any restricted account becomes a surveillance window into containers it should not see, across all monitored hosts.

CVSS 3.1 subscores map as follows: AV:N (reachable over the network), AC:L (no special conditions), PR:L (requires any authenticated account), UI:N (no victim interaction), S:U (no scope change), C:L (limited confidentiality loss), I:N and A:N (no integrity or availability impact). The score of 4.3 reflects a moderate-severity metadata leak. The most material exposures are full label maps and container images, which reveal orchestration intent, team ownership, and application inventory, and deployment/restart activity, which reveals operational cadence and change-management timing. CISA KEV does not list this CVE, and no in-the-wild exploitation has been reported.

Detection Guidance

Sigma Rule

title: Dozzle Unauthorized Event Stream Access by Restricted Account
id: 8f3c2a91-6b4d-4e7a-9c1f-dozzle62286
status: experimental
description: Detects authenticated requests to the Dozzle /api/events/stream endpoint that may indicate a restricted account accessing telemetry outside its label scope (CVE-2026-62286).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-62286
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: dozzle
detection:
  selection:
    cs-method: 'GET'
    cs-uri-stem|contains: '/api/events/stream'
  condition: selection
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
falsepositives:
  - Legitimate monitoring clients and authorized dashboards
level: low

YARA Rule

rule CVE_2026_62286_Dozzle_StreamEvents_MissingFilter
{
    meta:
        description = "Detects Dozzle builds prior to 10.6.7 where streamEvents in internal/web/events.go lacks label filter enforcement on stat/event channels"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-62286"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $ep   = "/api/events/stream" ascii
        $file = "internal/web/events.go" ascii
        $fn   = "streamEvents" ascii
        $vuln = "10.6.6" ascii

    condition:
        ($ep or $file or $fn) and filesize < 50MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-62286 Dozzle Unauthorized Event Stream Access"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/events/stream"; classtype:attempted-recon; sid:90062286; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-62286;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [network where http.request.method == "GET" and url.path == "/api/events/stream"]
  [network where http.request.method == "GET" and url.path == "/api/events/stream"]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="/api/events/stream" method=GET
| stats count values(status) as statuses by src_ip user
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="dozzle,web,">
  <rule id="100286" level="5">
    <if_sid>31100</if_sid>
    <url>/api/events/stream</url>
    <description>CVE-2026-62286 - Dozzle event stream accessed; possible restricted-user filter bypass</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 — CLAIMED. A single source (the GHSA advisory) tracks the fix at version 10.6.7, and this has not been independently confirmed. Treat the version reference as provisional and validate against the vendor's own release artifacts.

1. Immediate mitigations. Because the vulnerability only affects simple-auth deployments that rely on per-user label filters, one immediate mitigation is to disable per-user filtering as an assumed boundary until patching is possible — i.e., do not grant restricted accounts to users who must not see certain containers. Where per-user filters are essential, restrict network access to the Dozzle API and UI (for example, behind a reverse proxy or internal-only network segment) so that untrusted or low-privilege accounts cannot reach GET /api/events/stream. Audit existing restricted accounts and the containers visible through their streams.

2. Patch / upgrade steps. Upgrade Dozzle to version 10.6.7 or later, which the advisory reports fixes the issue. Verify the upgrade by confirming the running version and, in a controlled environment with a restricted account, validating that container-stat and container-event channels for out-of-scope containers are no longer delivered. Because patch confidence is claimed rather than confirmed, independently verify the fix behavior rather than relying on the version string alone.

3. Long-term hardening. Enforce a single, centralized authorization check that applies per-user label filters uniformly across all code paths serving container data — list endpoints and streaming endpoints alike — to prevent future inconsistencies like the one in streamEvents. Add regression tests that assert restricted users receive no events for out-of-scope containers. Apply least-privilege account provisioning, minimize the number of restricted accounts, and monitor for anomalous volumes of stream subscriptions from any single identity. Keep Dozzle updated and subscribe to its security advisories.

References

1. NVD — CVE-2026-62286: https://nvd.nist.gov/vuln/detail/CVE-2026-62286
2. GitHub Security Advisory (GHSA) for Dozzle 10.6.7 — referenced as the patch source (patch confidence 2/4, single source)
3. Dozzle project repository and release notes (version 10.6.7)
4. CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
5. CISA Known Exploited Vulnerabilities Catalog — CVE-2026-62286 is NOT listed; no known in-the-wild exploitation or threat actor campaign has been reported at this time.