cve.bz

CVE-2026-24740

8.7 highEPSS 0.4%

High (8.7) in amirraminfar dozzle. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in github.com/amir20/dozzle 1.29.1-0.20260125230338-620e59aa2463.

Dozzle is a realtime log viewer for docker containers. Prior to version 9.0.3, a flaw in Dozzle’s agent-backed shell endpoints allows a user restricted by label filters (for example, `label=env=dev`) to obtain an interactive root shell in out‑of‑scope containers (for example, `env=prod`) on the same agent host by directly targeting their container IDs. Version 9.0.3 contains a patch for the issue.

Severity

CVSS 4.0

8.7 high
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

9.9 critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
EPSS
0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-31)
CWEs
CWE-863, CWE-284
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-m855-r557-5rc5Gogithub.com/amir20/dozzle<1.29.1-0.20260125230338-620e59aa24631.29.1-0.20260125230338-620e59aa2463
GO-2026-4380Gogithub.com/amir20/dozzle<1.29.1-0.20260125230338-620e59aa24631.29.1-0.20260125230338-620e59aa2463

References

Check your stackJSON