CVE-2026-73087 Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher
An authenticated user can bypass SSRF protections in Dozzle to access internal network resources via IPv6 transition addresses.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73087?
CVE-2026-73087 is a low-severity server-side request forgery vulnerability in amir20 dozzle, published on 11 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Dozzle is a realtime log viewer for docker containers. From 10.5.2 until 10.6.15, the isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, used by safeDialContext for webhook notification URLs, does not inspect IPv4 addresses embedded in 6to4, NAT64, Teredo, or IPv4-compatible IPv6 addresses, allowing an authenticated user to reach loopback or link-local targets that the guard intends to block. This issue is fixed in version 10.6.15.
Weakness: CWE-918
Which versions are affected by CVE-2026-73087?
3 open source packages ship an affected version, including github.com/amir20/dozzle.
| Package | Affected | Fixed in |
|---|---|---|
github.com/amir20/dozzle Go | All versions | 1.29.1-0.20260804193351-8cf7ccd5ee04 |
github.com/amir20/dozzle Go | All versions | 1.29.1-0.20260804193351-8cf7ccd5ee04 |
github.com/amir20/dozzle Go | All versions | 1.29.1-0.20260804193351-8cf7ccd5ee04 |
How do I fix CVE-2026-73087?
Upgrade github.com/amir20/dozzle to 1.29.1-0.20260804193351-8cf7ccd5ee04 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-73087 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73087 exists.
Sources
Also known as GHSA-p2w3-6x73-2f6x, GO-2026-6440.