CVE-2026-45298

HIGH NUCLEI

Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)

Title source: cna
STIX 2.1

Exploitation Summary

CVE-2026-45298 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy (the documented quickstart, no DOZZLE_AUTH_PROVIDER set), POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-controlled URL into a WebhookDispatcher that sends an HTTP POST to the supplied URL with attacker-controlled request headers, and returns the response status code AND up to 1MB of the response body to the caller, when the target replies non-2xx. This vulnerability is fixed in 10.5.2.

Nuclei Templates (1)

Dozzle - Server Side Request Forgery
HIGHVERIFIEDby theamanrawat

References (2)

Core 2
Core References
X_Refsource_Misc x_refsource_misc
https://github.com/amir20/dozzle/releases/tag/v10.5.2

Scores

CVSS v3 8.6
EPSS 0.0283
EPSS Percentile 86.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-918
Status published
Products (3)
amir20/dozzle 0 - 8.14.12Go
amir20/dozzle < 10.5.2
amirraminfar/dozzle < 10.5.2
Published May 26, 2026
Tracked Since May 27, 2026