CVE Intelligence
Analysis AI-assisted

CVE-2026-24740: Dozzle Incorrect Authorization in Agent Shell Endpoints

Dozzle versions before 9.0.3 contain an incorrect authorization flaw in agent-backed shell endpoints. A user restricted by label filters may reach an interactive root shell in containers outside their scope on the same agent host. Upgrading to version 9.0.3, which contains the patch, is the primary remedy.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Dozzle is a realtime log viewer for Docker containers. According to the record, a flaw in its agent-backed shell endpoints (CWE-863, Incorrect Authorization) lets a user restricted by label filters reach containers outside their scope on the same agent host. The issue is fixed in version 9.0.3.

Impact

  • The record describes an interactive root shell in out-of-scope containers on the same agent host.
  • NVD scores the issue at CVSS 3.1 9.9 (vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L). GitHub scores it at CVSS 4.0 8.7.
  • The CVSS 3.1 vector rates confidentiality and integrity impact as High and availability impact as Low.

Affected products and versions

  • Listed product: Amirraminfar Dozzle, versions below 9.0.3.
  • Version 9.0.3 is stated to contain the patch.
  • The record references a fix commit and the 9.0.3 release page.

Exploitation status

CISA KEV does not list this CVE in the record. No confirmed active exploitation appears in the sources consulted. The vendor advisory carries an 'Exploit' tag in the record, but the record provides no exploitation details.

Remediation and mitigation

  • Upgrade Dozzle to version 9.0.3 or later.
  • Until the upgrade is complete, review who can reach agent-backed endpoints and reduce that exposure, following the mitigation guidance in the vendor advisory.
  • Review label-based access policies. Label filters did not prevent access to out-of-scope container IDs in the reported flaw.

Detection guidance

  • Review Dozzle and agent host logs for shell sessions opened against containers outside the expected label scope.
  • Inventory Dozzle instances running versions below 9.0.3 and the hosts where agents are deployed.
  • Monitor for unexpected root sessions inside production containers.

Limitations of the available information

The record contains no EPSS or SSVC data. It gives no technical reproduction details and does not describe the agent deployment model. The mitigation is only referenced, not described in the record.

Frequently asked questions

Which Dozzle versions are affected?

The record lists Dozzle versions below 9.0.3 as affected. Version 9.0.3 is stated to contain the patch.

Is this vulnerability known to be exploited?

CISA KEV does not list it in the record, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.