A flaw in Dozzle’s agent‑backed shell endpoints allows an attacker who is already granted access to the Dozzle interface but restricted by label filters (for example, label=env=dev) to directly target the container IDs of out‑of‑scope containers (for example, env=prod). By sending shell requests for those containers, the attacker obtains an interactive root shell on the agent host, bypassing intended access controls. This demonstrates an Access Control weakness and a missing authorization flaw, as catalogued by CWE‑284 and CWE‑863.

The vulnerability affects the Dozzle log viewer for Docker containers provided by amir20. Any deployment of Dozzle before version 9.0.3 is susceptible. The issue is present in the agent component that processes shell commands, regardless of the Docker host or the number of containers. The patch was supplied in release 9.0.3.

The CVSS score of 8.7 reflects a high‑severity flaw. The EPSS score is less than 1%, indicating a low probability of public exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, an attacker with even minimal access to the Dozzle web interface can exploit the bug by using direct container IDs, which requires no special privileges beyond those granted by the label filter. If the attacker gains access to the agent host, the impact is full root control over the host and any containers running on it.