CVE-2026-62286

Name of the Vulnerable Software and Affected Versions Dozzle versions prior to 10.6.7

Description In simple-auth deployments using per-user filters, the streamEvents function in internal/web/events.go fails to apply label filters to the container-stat and container-event channels returned by the 'GET /api/events/stream' endpoint. This allows authenticated restricted accounts to receive resource telemetry and lifecycle events for containers outside their authorized label scope. Exposed data includes container names, images, full label maps, CPU and memory usage, network and disk totals, and deployment or restart activity across monitored hosts. This does not include log contents, environment values, or exec access.

Recommendations Update to version 10.6.7.