The vulnerability in amir20 dozzle (CVE-2026-44985) arises from improper origin validation in the WebSocket upgrader for the /exec and /attach endpoints. The CheckOrigin function always returns true, allowing WebSocket upgrade requests from any origin. Because the JWT cookie uses SameSite: Lax, an attacker hosting a page on a same-site origin (such as a sibling subdomain or localhost) can exploit this to hijack the WebSocket connection, leveraging the victim's valid JWT cookie to gain interactive shell access to any container the victim is authorized to access. This is classified under CWE-346 (Origin Validation Error). The issue is resolved in dozzle version 10.5.2.

An attacker can gain interactive shell access to docker containers accessible by the victim by exploiting Cross-Site WebSocket Hijacking due to the lack of origin validation. This compromises container integrity and confidentiality for affected versions prior to 10.5.2. The CVSS 4.0 score is 8.7 (high severity), reflecting network attack vector, no required privileges or user interaction, and high impact on integrity.

Upgrade dozzle to version 10.5.2 or later, where the origin validation issue in the WebSocket upgrader is fixed. No other official remediation or temporary fix is documented. Patch status is not explicitly confirmed in vendor advisory content, but the description states the vulnerability is fixed in 10.5.2, indicating an official fix is available.