Dozzle’s WebSocket upgrade handler for the /exec and /attach endpoints accepted connections from any origin because CheckOrigin always returned true. Coupled with a JWT cookie that had SameSite set to Lax, this allowed a malicious page hosted on a subdomain or localhost to initiate a WebSocket connection to the exec endpoint. The victim’s cookie was automatically sent, giving the attacker an interactive shell inside any container the victim could access. The attacker can then run arbitrary commands within the container, read or modify data, and potentially move laterally within the host environment. The vulnerability is a classic example of Cross‑Site WebSocket Hijacking (CWE‑346).

The affected product is Dozzle, a real‑time Docker log viewer, with all releases prior to v10.5.2 vulnerable. Versions v10.5.2 and later contain the fix.

The CVSS score of 8.7 indicates high severity and the possibility of critical impact on confidentiality, integrity, and availability. EPSS information is not available, so the exploitation probability cannot be quantified, but the vulnerability is actively referenced in advisory links. The vulnerability is not listed in CISA’s KEV catalog, yet an attacker can realistically exploit it from a same‑site subdomain or an attacker‑controlled localhost service. The attack requires only that the victim has a valid JWT cookie and that the victim visits a malicious page that initiates the WebSocket connection. Once the connection is established, the attacker gains shell access to the container. The lack of a pre-existing network barrier makes this exploitation straightforward for an authenticated user or any user who can access the Dozzle interface.