CVE-2026-45298

Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)

Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy (the documented quickstart, no DOZZLE_AUTH_PROVIDER set), POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-controlled URL into a WebhookDispatcher that sends an HTTP POST to the supplied URL with attacker-controlled request headers, and returns the response status code AND up to 1MB of the response body to the caller, when the target replies non-2xx. This vulnerability is fixed in 10.5.2.

Affected

amir20 · dozzle

CVSS v3.1 NVD

8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS

1.60% chance of exploitation in the next 30 days, 76th percentile

Nuclei

high · CWE-918

Published

2026-05-26

Updated

2026-05-27

Proof-of-concept exploits (1)

• advisories/GHSA-3v9w-6365-9w54

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-45298.yaml

Security advisories

• amir20/dozzle/security/advisories/GHSA-3v9w-6365-9w54
• amir20/dozzle/releases/tag/v10.5.2

References

• CVE Record
• NVD entry