8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44985

CVE-2026-44985: Dozzle: Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpoints bypasses authentication

Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, he WebSocket upgrader for the /exec and /attach endpoints uses CheckOrigin: func(r *http.Request) bool { return true }, accepting upgrade requests from any origin. Combined with the JWT cookie using SameSite: Lax, this enables Cross-Site WebSocket Hijacking (CSWSH). An attacker hosting a page on a same-site origin (e.g., a sibling subdomain, or another service on localhost) can initiate a WebSocket connection to the exec endpoint that carries the victim's valid JWT cookie, gaining interactive shell access in any container the victim is authorized to access. This vulnerability is fixed in 10.5.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44985

CVE-2026-44985:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/amir20/dozzle	go	<= 10.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Cross-Site WebSocket Hijacking (CSWSH) in Dozzle, affecting the /exec and /attach endpoints. The root cause is an insecure configuration of the WebSocket upgrader in internal/web/terminal.go. The CheckOrigin function was set to always return true, effectively disabling same-origin policy and allowing WebSocket connections from any origin. This, combined with the SameSite=Lax setting for the JWT authentication cookie, allowed an attacker to craft a malicious webpage. When a logged-in Dozzle user visits this page, the browser automatically includes the authentication cookie in the cross-origin WebSocket request. This allows the attacker's site to hijack the authenticated session and gain shell access to any container the victim is authorized to access. The vulnerable functions are web.handler.attach and web.handler.exec, as they are the handlers for the /attach and /exec endpoints and utilize the misconfigured WebSocket upgrader. The fix was to remove the insecure CheckOrigin override, restoring the default behavior of the gorilla/websocket library, which rejects cross-origin requests.

Vulnerable functions

web.handler.attach

internal/web/terminal.go

The `attach` function uses a websocket upgrader that does not validate the origin of the request. This allows a malicious website to initiate a websocket connection to the `/attach` endpoint. If a user is authenticated with Dozzle, the browser will send the authentication cookie along with the request, allowing the attacker to hijack the user's session and attach to a container.

web.handler.exec

internal/web/terminal.go

The `exec` function uses a websocket upgrader that does not validate the origin of the request. This allows a malicious website to initiate a websocket connection to the `/exec` endpoint. If a user is authenticated with Dozzle, the browser will send the authentication cookie along with the request, allowing the attacker to hijack the user's session and execute commands in a container.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.