VYPR
Get started
← All advisories
High severityOSV Advisory· Published Jan 27, 2026· Updated Jan 28, 2026

Dozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Access

CVE-2026-24740

Description

Dozzle is a realtime log viewer for docker containers. Prior to version 9.0.3, a flaw in Dozzle’s agent-backed shell endpoints allows a user restricted by label filters (for example, label=env=dev) to obtain an interactive root shell in out‑of‑scope containers (for example, env=prod) on the same agent host by directly targeting their container IDs. Version 9.0.3 contains a patch for the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/amir20/dozzleGo
< 1.29.1-0.20260125230338-620e59aa24631.29.1-0.20260125230338-620e59aa2463

Affected products

1

Patches

1
620e59aa2463

fix: fixes incorrect user scope for agent.find

https://github.com/amir20/dozzleAmir RaminfarJan 25, 2026via ghsa
commit
3 files changed · +13 −4
  • internal/agent/client.go+11 −2 modified
    @@ -274,8 +274,17 @@ func (c *Client) StreamNewContainers(ctx context.Context, containers chan<- cont
 	}
 }
 
-func (c *Client) FindContainer(ctx context.Context, containerID string) (container.Container, error) {
-	response, err := c.client.FindContainer(ctx, &pb.FindContainerRequest{ContainerId: containerID})
+func (c *Client) FindContainer(ctx context.Context, containerID string, labels container.ContainerLabels) (container.Container, error) {
+	in := &pb.FindContainerRequest{ContainerId: containerID}
+
+	if labels != nil {
+		in.Filter = make(map[string]*pb.RepeatedString)
+		for k, v := range labels {
+			in.Filter[k] = &pb.RepeatedString{Values: v}
+		}
+	}
+
+	response, err := c.client.FindContainer(ctx, in)
 	if err != nil {
 		return container.Container{}, err
 	}
  • internal/agent/client_test.go+1 −1 modified
    @@ -138,7 +138,7 @@ func TestFindContainer(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	c, _ := rpc.FindContainer(context.Background(), "123456")
+	c, _ := rpc.FindContainer(context.Background(), "123456", container.ContainerLabels{})
 
 	assert.Equal(t, wantedContainer, c)
 }
  • internal/support/container/agent_service.go+1 −1 modified
    @@ -26,7 +26,7 @@ func NewAgentService(client *agent.Client) ClientService {
 }
 
 func (a *agentService) FindContainer(ctx context.Context, id string, labels container.ContainerLabels) (container.Container, error) {
-	return a.client.FindContainer(ctx, id)
+	return a.client.FindContainer(ctx, id, labels)
 }
 
 func (a *agentService) RawLogs(ctx context.Context, container container.Container, from time.Time, to time.Time, stdTypes container.StdType) (io.ReadCloser, error) {

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.