Dozzle EUVD-2026-56556

Exploitation requires an authenticated Dozzle session with permission to configure webhook notification URLs (PR:L); unauthenticated exploitation is not possible. The attacker must supply a webhook URL resolving to an IPv6 transition address that embeds a blocked IPv4: 6to4 (2002::/16), NAT64 well-known prefix (64:ff9b::/96), NAT64 local-use prefix (64:ff9b:1::/48), Teredo (2001::/32), or IPv4-compatible (::a.b.c.d). The guard bypass is limited to loopback (127.0.0.1) and link-local (169.254.x.x) address space - not arbitrary RFC1918 ranges - so reachable targets are localhost services running on the Dozzle host and, in cloud deployments, the IMDS endpoint. Exploitation is not possible when webhook notifications are disabled or when webhook URL configuration is restricted to fully trusted administrators. The SSVC automatable:no rating reflects that an attacker must understand IPv6 transition address construction to craft a valid bypass payload.

The CVSS 4.0 score of 2.3 is a credible reflection of actual risk. The AT:P (attack prerequisites present) and PR:L (authenticated) metrics are the key limiters: an attacker must already hold a Dozzle account with webhook configuration privileges. SSVC rates automatable as no and technical impact as partial, consistent with a constrained SSRF that only reaches loopback and link-local ranges rather than arbitrary internal RFC1918 space. The confidentiality impact is low in isolation - reading localhost services - but escalates materially in cloud-hosted deployments where 169.254.169.254 (IMDS) is accessible and could yield IAM credentials; this cloud-amplified scenario is not reflected in the base score and should be assessed separately by operators. SSVC classifies exploitation as poc, indicating exploit code exists, but there is no CISA KEV listing to confirm active in-the-wild exploitation. No conflicting signals between CVSS and description are present; the network attack vector is accurate because the webhook URL is submitted via Dozzle's network-accessible interface.

An authenticated Dozzle user with access to webhook notification settings configures a webhook pointing to a hostname or literal IPv6 address that encodes an internal target - for example, 2002:7f00:0001::1 for loopback (127.0.0.1) or 64:ff9b::a9fe:a9fe for the cloud metadata service (169.254.169.254). When a container log event triggers the webhook dispatcher, safeDialContext evaluates the resolved IPv6 address through isBlockedIP, which passes the address without extracting the embedded IPv4, allowing an outbound connection to the intended internal target. A proof-of-concept exists per SSVC classification.