Skip to content
Heist/ feed
MediumFix available

Dozzle label filters do not restrict container event and statistics streams

Type: advisorySource: OSV1 source record

## Summary Dozzle supports per-user label filters in `users.yml` that are documented as an access-control boundary: "Filters are used to restrict the containers that a user can see" and "the `guest` user can only see containers with the label `com.example.app` … useful for restricting access to specific containers" (docs/guide/authentication.md). This is the mechanism operators use to give different users/tenants visibility into disjoint subsets of containers on the same host. The events stream handler `streamEvents` (GET `/api/events/stream`) honors that filter for the initial container list and for the incremental `containers-changed` updates, but it forwards two other channels — `container-stat` (live per-container CPU, memory, network and disk telemetry) and `container-event` (container lifecycle events: start/die/destroy/rename/pause/unpause, with the container's full attribute/label set) — to every authenticated client unconditionally, with no comparison against the caller's label filter. The upstream subscription `SubscribeEventsAndStats` fans out across every Docker client/host and never receives a label filter at all. As a result, any authenticated user — including one explicitly constrained to a single label scope — receives live resource telemetry for every container on every monitored host, plus lifecycle events carrying each container's name, image and complete label map. This crosses the exact isolation boundary the filter feature is documented to enforce. The l

Announced Source revision 1
Original source ↗

GHSA-xcw9-qmmf-vqxj

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-xcw9-qmmf-vqxj

github.com/amir20/dozzle

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
1.29.1-0.20260622172006-19c01e0fb491

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.29.1-0.20260622172006-19c01e0fb491"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/amir20/dozzle",
      "purl": "pkg:golang/github.com/amir20/dozzle",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-xcw9-qmmf-vqxj/GHSA-xcw9-qmmf-vqxj.json"
    }
  }
]
Related CVEs
CVE-2026-62286

Source reference: /aliases

Publisher severity

No explicit severity was provided.

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-62286 · Medium

dozzle

Event
#63942 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement