Dozzle versions before 10.6.7 have an information exposure vulnerability where the streamEvents function applies label filters to container lists but not to container-stat and container-event channels returned by the GET /api/events/stream endpoint. As a result, authenticated restricted users in simple-auth deployments with per-user filters can receive telemetry and lifecycle events for containers beyond their authorized label scope. The leaked data includes container names, images, full label maps, CPU and memory usage, network and disk totals, and deployment or restart activities across monitored hosts. The vulnerability does not expose log contents, environment variables, or allow exec access. The issue is resolved in version 10.6.7.

Restricted users can access sensitive container telemetry and lifecycle event data for containers outside their authorized label scope. This exposure includes metadata and resource usage information but does not include logs, environment variables, or execution capabilities. The confidentiality of container operational data is compromised, potentially aiding attackers in reconnaissance or unauthorized monitoring.

Upgrade to dozzle version 10.6.7 or later, where this vulnerability is fixed. No other mitigation is required as the fix is official and addresses the issue directly.