CVE-2026-73087
Summary
The isBlockedIP SSRF guard in Dozzle's webhook notification dispatcher blocks loopback, link-local, multicast, and unspecified addresses but does not recognize IPv6 transition mechanism addresses (RFC 3056 6to4, RFC 6052 NAT64, RFC 4380 Teredo) that embed arbitrary IPv4 addresses. An authenticated user can bypass the guard to reach loopback services, cloud metadata endpoints (169.254.169.254), and other blocked ranges via webhook notification URLs.
Affected component / versions
- Package: github.com/amir20/dozzle
- Affected versions: all versions with SSRF guard (current HEAD b9df313)
- Vulnerable code: internal/notification/dispatcher/webhook.go
Details
Root cause (CWE-918)
internal/notification/dispatcher/webhook.go:32-51:
func isBlockedIP(ip net.IP) bool {
if ip.IsLoopback() ||
ip.IsLinkLocalUnicast() ||
ip.IsLinkLocalMulticast() ||
ip.IsMulticast() ||
ip.IsInterfaceLocalMulticast() ||
ip.IsUnspecified() {
return true
}
if v4 := ip.To4(); v4 != nil && zeroNetV4.Contains(v4) {
return true
}
if ip.Equal(net.IPv4bcast) {
return true
}
return false
}
The guard intentionally allows RFC 1918 private ranges for self-hosted webhook targets, but blocks loopback (127.0.0.0/8, ::1), link-local (169.254.0.0/16, fe80::/10), and other non-routable addresses. IPv6 transition mechanism addresses bypass all these checks:
| Mechanism | Prefix | Embeds | isBlockedIP result |
|-----------|--------|--------|---------------------|
| 6to4 | 2002::/16 | any IPv4 in bits 16-47 | false |
| NAT64 WKP | 64:ff9b::/96 | any IPv4 in bits 96-127 | false |
| Teredo | 2001:0000::/32 | any IPv4 in bits 96-127 | false |
Reachability / trust boundary
The safeDialContext function (line 53) resolves hostnames and checks each IP against isBlockedIP before establishing a TCP connection. This is used as the DialContext for the webhook HTTP client (line 115).
Webhook URLs are configured by authenticated Dozzle users through the notification settings UI. The guard exists to prevent auth
⚡ Watch CVE-2026-73087
Get an email if CVE-2026-73087 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-73087)