CVE-2026-73087 Overview
CVE-2026-73087 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Dozzle, a realtime log viewer for Docker containers. The flaw affects versions from 10.5.2 through 10.6.14. The isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, used by safeDialContext for webhook notification URLs, fails to inspect IPv4 addresses embedded in IPv6 transition formats. These formats include 6to4, NAT64, Teredo, and IPv4-compatible IPv6 addresses. An authenticated user can craft a webhook URL that resolves to loopback or link-local targets the guard intends to block. The issue is fixed in version 10.6.15.
Critical Impact
An authenticated Dozzle user can bypass the SSRF guard to reach internal loopback or link-local endpoints through IPv6 transition address formats.
Affected Products
- Dozzle versions 10.5.2 through 10.6.14
- internal/notification/dispatcher/webhook.go component
- Webhook notification subsystem using safeDialContext
Discovery Timeline
- 2026-08-11 - CVE-2026-73087 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-73087
Vulnerability Analysis
Dozzle implements an SSRF guard named isBlockedIP inside its webhook dispatcher. The guard runs during safeDialContext to prevent webhook URLs from resolving to internal or restricted network ranges. The implementation inspects IPv4 addresses and standard IPv6 addresses but does not decode IPv4 addresses embedded within IPv6 transition mechanisms.
An authenticated attacker with permission to configure webhook notification URLs can supply a target that uses a 6to4, NAT64, Teredo, or IPv4-compatible IPv6 address. The embedded IPv4 portion may point to loopback (127.0.0.0/8) or link-local (169.254.0.0/16) ranges. Because the guard does not extract and re-check the embedded IPv4 address, the connection proceeds.
Successful exploitation allows the Dozzle server to issue outbound HTTP requests to internal services accessible only from the host. The confidentiality impact is limited, matching the low-severity classification.
Root Cause
The root cause is incomplete input validation in the SSRF blocklist logic. The isBlockedIP function evaluates the outer address family but does not normalize IPv6 transition formats to their embedded IPv4 representation before comparing against blocked ranges. Address families such as 2002::/16 (6to4), 64:ff9b::/96 (NAT64), 2001::/32 (Teredo), and ::ffff:0:0/96 (IPv4-compatible) all encode an IPv4 address that must be inspected separately.
Attack Vector
Exploitation requires authenticated access to Dozzle and permission to define a webhook notification URL. The attacker submits a URL whose hostname or IP literal resolves to an IPv6 transition address encoding a restricted IPv4 target. Dozzle then dials the address through safeDialContext, bypassing the guard and reaching the internal endpoint.
// Patch imports from internal/notification/dispatcher/webhook.go
"net"
"net/http"
"net/url"
+ "slices"
"strings"
"text/template"
"time"
Source: GitHub commit 8cf7ccd. The patch adds transition-address handling so the SSRF guard extracts and validates embedded IPv4 addresses before dialing.
Detection Methods for CVE-2026-73087
Indicators of Compromise
- Webhook notification configurations containing IPv6 literals in the 2002::/16, 64:ff9b::/96, 2001::/32, or ::ffff:0:0/96 ranges.
- Outbound HTTP requests from the Dozzle container to loopback or link-local addresses following webhook configuration changes.
- Audit log entries showing webhook creation or edits by non-administrative authenticated users.
Detection Strategies
- Inspect the Dozzle configuration store for webhook URLs referencing IPv6 transition prefixes.
- Review reverse proxy and container network logs for connections to internal ranges originating from the Dozzle process.
- Correlate authenticated Dozzle sessions with unexpected outbound connections to internal service ports.
Monitoring Recommendations
- Alert on Dozzle egress traffic to RFC1918, loopback, or link-local destinations.
- Log all webhook configuration changes with the acting user identity and submitted URL.
- Baseline expected webhook destinations and flag deviations for review.
How to Mitigate CVE-2026-73087
Immediate Actions Required
- Upgrade Dozzle to version 10.6.15 or later, which fixes the SSRF guard.
- Audit existing webhook notification URLs and remove any using IPv6 transition prefixes.
- Restrict webhook configuration permissions to trusted administrators only.
- Place the Dozzle container behind egress firewall rules that deny access to loopback and link-local networks.
Patch Information
The fix is included in Dozzle 10.6.15. See the GitHub Security Advisory GHSA-p2w3-6x73-2f6x, the GitHub Pull Request #4887, and the 10.6.15 release notes for details.
Workarounds
- Enforce egress network policies that block outbound traffic from Dozzle to internal IP ranges.
- Disable the webhook notification feature until the upgrade is applied.
- Limit Dozzle authentication to administrators while remediation is in progress.
# Example Docker egress restriction using iptables on the host
iptables -I DOCKER-USER -s <dozzle_container_ip> -d 127.0.0.0/8 -j DROP
iptables -I DOCKER-USER -s <dozzle_container_ip> -d 169.254.0.0/16 -j DROP
iptables -I DOCKER-USER -s <dozzle_container_ip> -d 10.0.0.0/8 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
