CVE-2026-73087

Executive Summary

CVE-2026-73087 is a server-side request forgery (SSRF) vulnerability in Dozzle, a realtime log viewer for Docker containers. Affected versions from 10.5.2 up to (but not including) 10.6.15 fail to block IPv4 addresses embedded in IPv6 transition-encoding schemes when validating webhook notification URLs, allowing an authenticated user to reach loopback or link-local resources that the SSRF guard intends to block. The issue is remediated in version 10.6.15; no public exploit, PoC, or CISA KEV listing exists as of this report, and the patch is currently confirmed by a single source (OSV), giving a patch confidence of 2/4.

Technical Analysis

Dozzle provides a browser-based realtime log stream for Docker containers and supports outbound webhook notifications. The NVD description identifies two code elements involved in the flaw: the isBlockedIP guard located in internal/notification/dispatcher/webhook.go, and safeDialContext, which is used when opening connections to webhook notification URLs. The guard is designed to block outbound connections to sensitive destinations such as loopback (127.0.0.0/8, ::1) and link-local space (e.g., 169.254.0.0/16, fe80::/10). Any authenticated user capable of configuring a webhook notification consequently controls a server-side fetch primitive.

The vulnerability is a classification gap in IP parsing: isBlockedIP evaluates destination addresses but does not extract and inspect IPv4 octets embedded inside IPv6 transition/addressing forms. Specifically, the following encodings can carry an arbitrary IPv4 address that the guard fails to recognize:

• 6to4 (2002::/16): the embedded IPv4 address occupies bits 16–47 of the IPv6 address, e.g., 2002:7f00:1:: encodes 127.0.0.1.
• NAT64 / DNS64 (64:ff9b::/96): IPv4 is placed in the low 32 bits, e.g., 64:ff9b::7f00:1 encodes 127.0.0.1.
• Teredo (2001::/32): the IPv4 address is obfuscated in the last 32 bits after bitwise inversion, e.g., Teredo triples can encode loopback/private targets.
• IPv4-compatible IPv6 (::/96, deprecated but still accepted by some stacks): ::127.0.0.1 and ::ffff:127.0.0.1 (IPv4-mapped) both evaluate to loopback destinations.

Because the validation occurs before the connection is dialed, and because many operating systems and Go's network stack will normalize these forms, the resulting TCP/TLS connection terminates at the IPv4 target despite the guard's intent. The precise implementation detail of why the parse succeeds is not disclosed beyond the description; however, the flaw class is a canonicalization/parsing inconsistency between the security control and the underlying network stack. Insufficient technical detail is available to state whether the bypass requires URL brackets, percent-encoding, or hostname resolution via DNS64, but the vulnerability class is clear: an SSRF blocklist that can be evaded through alternative IP representations.

The attack surface is the Dozzle web application (default listening port 8080), exposed to authenticated users. The feature that processes user-supplied URLs is the webhook notification dispatcher, invoked when a notification event fires or when connectivity is tested. Dozzle frequently runs as a privileged container, meaning the container's loopback and link-local namespace may include the Docker daemon API, other mesh/overlay interfaces, or cloud metadata services.

Exploitation Scenarios

There is no public PoC for CVE-2026-73087; the attack chain below is inferred from the NVD description and the SSRF vulnerability class.

1. Reconnaissance / target identification: An attacker identifies an exposed Dozzle instance (e.g., via Shodan or default port 8080) and authenticates with valid credentials. Users with notification/webhook configuration privileges are the relevant actor, since SSRF payloads are supplied via webhook URL configuration.

2. Triggering the flaw: The attacker navigates to the notification configuration interface and creates or modifies a webhook notification destination. The candidate URL is passed to safeDialContext, which consults isBlockedIP in internal/notification/dispatcher/webhook.go.

3. Payload / execution method: Instead of supplying a plain IPv4 literal (which the guard would block, e.g., http://127.0.0.1:2375/), the attacker encodes the target IPv4 in an IPv6 form: an IPv4-mapped or IPv4-compatible literal (http://[::ffff:127.0.0.1]:2375/), 6to4 (http://[2002:7f00:1::]:2375/), or NAT64 (http://[64:ff9b::7f00:1]:2375/). The guard does not inspect the embedded IPv4, the connection is permitted, and the server dials the transition-encoded address, which routes to the loopback or link-local IPv4 target.

4. Post-exploitation: The Dozzle server performs the request on behalf of the attacker, enabling access to services bound to loopback (e.g., Docker API on TCP or a local management interface), link-local infrastructure (e.g., cloud metadata service at 169.254.169.254 supplying instance credentials), or adjacent container/network services. Responses may be reflected back to the attacker if the webhook feature returns response content or error details, or the attacker can leverage timing/side channels to perform blind probing.

Impact Assessment

CVE-2026-73087 requires authentication, which lowers the practical likelihood of external exploitation; however, Dozzle deployments are often internet-facing for operational convenience, and a compromised low-privileged account is sufficient to exploit the flaw. The CVSS score is N/A — no vector string has been assigned by the CNA — while EPSS is 0.00267 (19.0th percentile), indicating a low current exploitation probability. The CISA KEV catalog does not list this CVE, and no exploit code is publicly available.

Blast radius is determined by what is reachable from the Dozzle container: in cloud deployments, the link-local endpoint 169.254.169.254 exposes instance metadata and temporary credentials; in Docker environments, the loopback interface may expose the Docker Engine API, which — if unauthenticated or weakly secured — can lead to container escape and host compromise. Even without such high-value targets, the SSRF enables internal network reconnaissance, port scanning, and access to internal web services, making this a medium-to-high business risk for internet-facing authenticated deployments.

Detection Guidance

The following detection content is designed to identify exploitation attempts and post-exploitation activity associated with CVE-2026-73087. Because no public exploit exists, these rules focus on authoritative indicators: outbound connections from the Dozzle process to loopback/link-local destinations, and configuration/traffic containing IPv4-in-IPv6 encoded addresses.

Sigma Rule

title: Dozzle Webhook SSRF - Outbound Connection to Loopback or Link-Local via IPv4-in-IPv6 (CVE-2026-73087)
id: e87faa2c-9b25-4f2a-a8e0-9be0e1c0e7c5
status: experimental
description: Detects the Dozzle process establishing network connections to loopback, link-local, or IPv4-in-IPv6 encoded destinations, indicating a potential SSRF guard bypass.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-73087
tags:
    - attack.t1190
    - attack.initial_access
    - cve.2026-73087
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 3
        Image|endswith:
            - '\dozzle.exe'
            - '\dozzle'
        DestinationIp|startswith:
            - '127.'
            - '169.254.'
            - '::ffff:127.'
            - '::ffff:169.254.'
            - '::127.'
            - '2002:'
            - '64:ff9b:'
            - '2001:'
    condition: selection
falsepositives:
    - Legitimate Dozzle health checks contacting localhost services
    - Monitoring agents on the same host querying local endpoints
level: high

YARA Rule

rule CVE_2026_73087_Dozzle_Webhook_IPv4inIPv6_Config
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects Dozzle webhook configuration content containing IPv4-in-IPv6 encoded loopback or link-local addresses indicative of CVE-2026-73087 SSRF payloads."
        cve = "CVE-2026-73087"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73087"
        date = "2026-05-15"
    strings:
        $ipv4mapped = "::ffff:127." ascii wide
        $ipv4mapped_meta = "::ffff:169.254" ascii wide
        $ipv4compat = "::127.0.0.1" ascii wide
        $nat64_1 = "64:ff9b::7f00:1" ascii wide
        $nat64_2 = "64:ff9b::a9fe:a9fe" ascii wide
        $six2four = "2002:7f00:1" ascii wide
        $teredo = "2001:0000:" ascii wide
        $url_bracket = "[::ffff:" ascii wide
    condition:
        any of them and filesize < 5MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Dozzle Webhook SSRF IPv4-in-IPv6 Encoding Attempt (CVE-2026-73087)"; flow:established,to_server; content:"http.uri"; http.uri; content:"[::ffff:"; nocase; http.uri; content:"127."; distance:0; http.uri; content:"[2002:"; nocase; distance:0; pcre:"/\[\s*(::ffff:|::|64:ff9b::|2002:)/Ui"; classtype:attempted-recon; reference:cve,2026-73087; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-73087; sid:7308701; rev:1;)

Note: because SSRF operates at the network layer and the encoded IPv6 may be normalized before dialing, payload-based IDS coverage is best paired with egress filtering and outbound netflow monitoring from the Dozzle host.

Elastic Detection

network where event.category == "network" and process.name in ("dozzle", "dozzle.exe")
    and (
        cidrMatch(destination.ip, "127.0.0.0/8")
        or cidrMatch(destination.ip, "169.254.0.0/16")
        or cidrMatch(destination.ip, " ::1/128")
        or destination.ip startsWith "::ffff:127."
        or destination.ip startsWith "::ffff:169.254."
        or destination.ip startsWith "64:ff9b::"
        or destination.ip startsWith "2002:"
        or destination.ip startsWith "::127."
    )

Splunk SPL Query

(index=windows OR index=sysmon) EventCode=3
  OR (sourcetype=netflow OR sourcetype=cisco:asa)
| where (dest_ip LIKE "127.%" OR dest_ip LIKE "169.254.%"
         OR dest_ip LIKE "::ffff:127.%" OR dest_ip LIKE "::ffff:169.254.%"
         OR dest_ip LIKE "64:ff9b::%" OR dest_ip LIKE "2002:%"
         OR dest_ip LIKE "::127.%" OR dest_ip LIKE "::1")
        AND (process_name LIKE "%dozzle%" OR vendor_id="dozzle" OR app="dozzle")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, dest_port, process_name, user
| sort - count

Wazuh OSSEC Rule

<group name="sysmon,network-connection,">
  <rule id="730871" level="12">
    <if_sid>92050</if_sid>
    <field name="win.eventdata.image" type="pcre2">(?i)dozzle</field>
    <field name="win.eventdata.destinationIp" type="pcre2">^(127\.|169\.254\.|::ffff:127\.|::ffff:169\.254\.|64:ff9b::|2002:|::127\.)</field>
    <description>CVE-2026-73087: Dozzle process attempted connection to loopback/link-local IPv4-in-IPv6 encoded destination</description>
    <group>ssrf,cve-2026-73087,dozzle,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED — only a single source, OSV, reports the fix, and it is not independently confirmed). Apply the following actions in order:

1. Immediate mitigations:

   • Restrict egress from the Dozzle container/host with a firewall that denies outbound connections to 127.0.0.0/8, 169.254.0.0/16, ::1, and IPv6 link-local/transition ranges (2002::/16, 64:ff9b::/96, 2001::/32, ::/96).
   • Restrict access to the Dozzle web UI to trusted networks or add a reverse proxy with strong authentication; enforce least-privilege so only authorized administrators can configure webhook notifications.
   • If cloud metadata access is a concern, disable the instance metadata service (IMDSv2 required) or use network policies that block traffic to the link-local metadata endpoint.

2. Patch/upgrade steps:

   • Upgrade Dozzle to version 10.6.15 or later, which fixes isBlockedIP/safeDialContext handling in internal/notification/dispatcher/webhook.go.
   • Independently verify the upstream release (GitHub releases) since the OSV patch claim is not yet independently confirmed; inspect the changelog for the 10.6.15 release notes.

3. Long-term hardening:

   • Implement strict allowlist validation for webhook notification URLs at the application layer (scheme, hostname/IP, port), not just IP blocklists.
   • Monitor outbound connections from the Dozzle process and alert on loopback/link-local destinations using the detection content above.
   • Consider network segmentation so that Dozzle cannot reach sensitive internal services; place it in a dedicated DMZ/tenant.
   • Track CISA KEV and vendor advisories for updates to patch confidence and any emerging in-the-wild exploitation.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-73087
• OSV Vulnerability Record (patch source): https://osv.dev/vulnerability/CVE-2026-73087
• Dozzle GitHub Repository / Releases: https://github.com/Dozzle/dozzle (returned 404 — verify manually)
• CWE-918 Server-Side Request Forgery: https://cwe.mitre.org/data/definitions/918.html
• CISA Known Exploited Vulnerabilities Catalog (not listed for this CVE): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat-actor campaigns or exploit-in-the-wild evidence are currently associated with CVE-2026-73087.