Dozzle label filters do not restrict container event and statistics streams
## Summary Dozzle supports per-user label filters in `users.yml` that are documented as an access-control boundary: "Filters are used to restrict the containers that a user can see" and "the `guest` user can only see containers with the label `com.example.app` … useful for restricting access to specific containers" (docs/guide/authentication.md). This is the mechanism operators use to give different users/tenants visibility into disjoint subsets of containers on the same host. The events stream handler `streamEvents` (GET `/api/events/stream`) honors that filter for the initial container list and for the incremental `containers-changed` updates, but it forwards two other channels — `container-stat` (live per-container CPU, memory, network and disk telemetry) and `container-event` (container lifecycle events: start/die/destroy/rename/pause/unpause, with the container's full attribute/label set) — to every authenticated client unconditionally, with no comparison against the caller's label filter. The upstream subscription `SubscribeEventsAndStats` fans out across every Docker client/host and never receives a label filter at all. As a result, any authenticated user — including one explicitly constrained to a single label scope — receives live resource telemetry for every container on every monitored host, plus lifecycle events carrying each container's name, image and complete label map. This crosses the exact isolation boundary the filter feature is documented to enforce. The l
GO-2026-6592
Revision 1
Dozzle label filters do not restrict container event and statistics streams in github.com/amir20/dozzle
Dozzle label filters do not restrict container event and statistics streams in github.com/amir20/dozzle
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GO-2026-6592
github.com/amir20/dozzle
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.29.1-0.20260622172006-19c01e0fb491
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.29.1-0.20260622172006-19c01e0fb491"
}
]
}
],
"package": {
"name": "github.com/amir20/dozzle",
"purl": "pkg:golang/github.com/amir20/dozzle",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://vuln.go.dev/ID/GO-2026-6592.json"
},
"ecosystem_specific": {}
}
]- Related CVEs
- CVE-2026-62286
Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #63852 · Revision 1
- Added to Heist Feed
- Publisher date
GHSA-xcw9-qmmf-vqxj
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-xcw9-qmmf-vqxj
github.com/amir20/dozzle
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.29.1-0.20260622172006-19c01e0fb491
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.29.1-0.20260622172006-19c01e0fb491"
}
]
}
],
"package": {
"name": "github.com/amir20/dozzle",
"purl": "pkg:golang/github.com/amir20/dozzle",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-xcw9-qmmf-vqxj/GHSA-xcw9-qmmf-vqxj.json"
}
}
]- Related CVEs
- CVE-2026-62286
Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #63942 · Revision 1
- Added to Heist Feed
- Publisher date