CVE-2026-44985
Last modified
CVE-2026-44985 is a critical-severity vulnerability rated 9.6/10 on the CVSS scale. Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, he WebSocket upgrader for the /exec and /attach endpoints uses CheckOrigin: func(r *http.Request) bool { return true }, accepting upgrade requests from any origin. EPSS estimates a 0.19% chance of exploitation in the next 30 days.
Description
Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, he WebSocket upgrader for the /exec and /attach endpoints uses CheckOrigin: func(r *http.Request) bool { return true }, accepting upgrade requests from any origin. Combined with the JWT cookie using SameSite: Lax, this enables Cross-Site WebSocket Hijacking (CSWSH). An attacker hosting a page on a same-site origin (e.g., a sibling subdomain, or another service on localhost) can initiate a WebSocket connection to the exec endpoint that carries the victim's valid JWT cookie, gaining interactive shell access in any container the victim is authorized to access. This vulnerability is fixed in 10.5.2.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Amirraminfar | Dozzle | < 10.5.2 |
References
- https://github.com/amir20/dozzle/releases/tag/v10.5.2Product, Release Notes
- https://github.com/amir20/dozzle/security/advisories/GHSA-j643-x8pv-8m67Exploit, Mitigation, Vendor Advisory
- https://github.com/amir20/dozzle/security/advisories/GHSA-j643-x8pv-8m67Exploit, Mitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-44985?
How severe is CVE-2026-44985?
How do I fix CVE-2026-44985?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-44978xrdp is an open source RDP server. Versions 0.10.6 and prior…5.3
- CVE-2026-44979@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when…6.3
- CVE-2026-4498Execution with Unnecessary Privileges (CWE-250) in Kibana’s …7.7
- CVE-2026-44981CrowdSec offers crowdsourced protection against malicious IP…8.2
- CVE-2026-44982CrowdSec offers crowdsourced protection against malicious IP…7.2
- CVE-2026-44983smallbitvec is a growable bit-vector for Rust, optimized for…7.3
- CVE-2026-44986Penpot is an open-source design tool for design and code col…9.9
- CVE-2026-44987SysReptor is a fully customizable pentest reporting platform…3.8
- CVE-2026-44988LibVNCClient is a library for easy implementation of a VNC c…8.8
- CVE-2026-4499A vulnerability was determined in D-Link DIR-820LW 2.03. Aff…9.8
- CVE-2026-44990ApostropheCMS is an open-source Node.js content management s…9.3
- CVE-2026-44991OpenClaw before 2026.4.21 contains an authorization bypass v…4.2
Are you affected by CVE-2026-44985?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST