Skip to content
Coollabsio Coolify vulnerabilities
-
coollabsio coolify
Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints
CVE-2026-121587
6.9 Medium
-
coollabsio coolify
coollabsio Coolify GitHub App Setup redirect missing authentication
CVE-2026-100746
6.9 Medium
-
coollabsio coolify
coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization
CVE-2026-100744
6.9 Medium
-
coollabsio coolify
Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching
CVE-2026-86117
9.2 Critical
-
coollabsio coolify
Coolify before 4.2.0 Remote Code Execution via Environment Variable Key
CVE-2026-84694
8.7 High
-
coollabsio coolify
coollabsio Coolify Policy Policies authorization
CVE-2026-15507
5.3 Medium
-
coollabsio coolify
Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution
CVE-2026-59734
Public exploit
8.8 High
-
coollabsio coolify
Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands
CVE-2026-42201
3.3 Low
-
coollabsio coolify
Coolify: Command injection via single-quote breakout in Docker Compose custom commands
CVE-2026-34158
8.8 High
-
coollabsio coolify
Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL
CVE-2026-34170
4.3 Medium
-
coollabsio coolify
Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()
CVE-2026-34037
9.9 Critical
-
coollabsio coolify
Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers
CVE-2026-34048
Public exploit
9.9 Critical
-
coollabsio coolify
Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name
CVE-2026-34057
8.8 High
-
coollabsio coolify
Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers
CVE-2026-42143
8.8 High
-
coollabsio coolify
Coolify: SSRF via S3 Storage Endpoint in testConnection()
CVE-2026-42147
4.9 Medium
-
coollabsio coolify
Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped)
CVE-2026-34044
7.7 High
-
coollabsio coolify
Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport)
CVE-2026-34152
8.8 High
-
coollabsio coolify
Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs
CVE-2026-34149
3.3 Low
-
coollabsio coolify
Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value
CVE-2026-34171
8.0 High
-
coollabsio coolify
Coolify: Host RCE via Sentinel token injection
CVE-2026-34034
8.8 High
-
coollabsio coolify
Coolify: Command injection via unsanitized persistent storage name in docker volume commands
CVE-2026-34168
8.8 High
-
coollabsio coolify
Coolify: File Upload Without Type or Size Validation in Database Backup Restore
CVE-2026-42145
3.1 Low
-
coollabsio coolify
Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing
CVE-2026-34198
5.3 Medium
-
coollabsio coolify
Coolify: OS Command Injection via Unmanaged Container Operations - Remote Code Execution
CVE-2026-34058
8.8 High
-
coollabsio coolify
Coolify: Host RCE via Log Drain secret/env command injection
CVE-2026-34035
8.8 High
-
coollabsio coolify
Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution
CVE-2026-34047
9.9 Critical
-
coollabsio coolify
Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Access
CVE-2026-42172
3.1 Low
-
coollabsio coolify
Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE
CVE-2026-42200
8.8 High
-
coollabsio coolify
Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container
CVE-2026-42153
8.8 High
-
coollabsio coolify
Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor
CVE-2026-34167
5.0 Medium
-
coollabsio coolify
Coolify: Command Injection via unsanitized MongoDB collection names in database backup
CVE-2026-34049
3.3 Low
-
coollabsio coolify
Coolify: Authenticated Remote Code Execution in GetLogs Livewire Component
CVE-2026-34599
8.8 High
-
coollabsio coolify
Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root
CVE-2026-42204
8.8 High
-
coollabsio coolify
Coolify: Command Injection via Unescaped Version String in Docker Build
CVE-2026-42148
3.8 Low
-
coollabsio coolify
Coolify LocalFileVolume fs_path command injection enables RCE
CVE-2026-34153
8.8 High
-
coollabsio coolify
Coolify unauthenticated feedback endpoint allows Discord webhook abuse
CVE-2026-41899
6.5 Medium
-
coollabsio coolify
Coolify Settings/Updates Livewire component missing instance administrator authorization
CVE-2026-34050
6.5 Medium
-
coollabsio coolify
Coolify read-scoped API tokens can perform state-changing validation operations
CVE-2026-32718
6.5 Medium
-
coollabsio coolify
Coolify authenticated remote command injection leading to RCE and secret exfiltration
CVE-2026-34038
Public exploit
9.9 Critical
-
coollabsio coolify
Coolify: Authenticated RCE via command injection in CA certificate management feature
CVE-2026-27957
8.8 High
-
coollabsio coolify
Coolify: Cross-team application domain enumeration via domains_by_server endpoint
CVE-2026-27956
4.3 Medium
-
coollabsio coolify
Coolify: Command Injection via Single-Quote Breakout in `executeInDocker()`
CVE-2026-27955
6.6 Medium
-
coollabsio coolify
Coolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosure
CVE-2026-27883
5.0 Medium
-
coollabsio coolify
Coolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR)
CVE-2026-27881
5.0 Medium
-
coollabsio coolify
Coolify: Timing Attack in GitLab Webhook Token Validation
CVE-2026-27882
4.8 Medium
-
coollabsio coolify
Coolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and Infrastructure
CVE-2026-34592
7.7 High
-
coollabsio coolify
Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management
CVE-2026-34594
8.8 High
-
coollabsio coolify
Coolify: Authenticated Host RCE
CVE-2026-34597
8.8 High
-
coollabsio coolify
Coolify: Unauthenticated Deployment Trigger via Webhook HMAC Bypass with Null Secret
CVE-2026-41896
7.5 High
-
coollabsio coolify
Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers
CVE-2026-57498
9.6 Critical
- Show olderLoading…