Skip to content
OpenAdvisories
High WID-SEC-2026-2089 7 CVEs

Coolify: Mehrere Schwachstellen

Published Jun 25, 2026 · Updated Jun 30, 2026 · Revision 3 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Coolify ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, und um Informationen offenzulegen.

Product

Coolify ist eine Open-Source-Plattform zur Vereinfachung der Bereitstellung und Verwaltung von Anwendungen.

Vulnerabilities 7

  • High 8.8
    CVE-2026-34594

    Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, an authenticated command injection vulnerability in the Destination Network Management functionality allows users with destination man…

    coollabsio coolify
  • High 8.8
    CVE-2026-34597

    Coolify: Authenticated Host RCE

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.470, a critical Authenticated Host Remote Code Execution (RCE) vulnerability was discovered in Coolify. The flaw resides in the handling of…

    coollabsio coolify
  • High 7.7
    CVE-2026-34592

    Coolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and Infrastructure

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, Coolify server and project lookups are not scoped to the current team, allowing any authenticated user to access servers and projects …

    coollabsio coolify
  • High 7.5
    CVE-2026-41896

    Coolify: Unauthenticated Deployment Trigger via Webhook HMAC Bypass with Null Secret

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the HMAC key is the application's manual_webhook_secret_github field, which is used by Coolify's webhook endpoints to validate incomin…

    coollabsio coolify
  • Medium 6.6
    CVE-2026-27955

    Coolify: Command Injection via Single-Quote Breakout in `executeInDocker()`

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the executeInDocker() helper wraps commands in bash -c '{$command}' without escaping single quotes. User-controlled docker_compose_cus…

    coollabsio coolify
  • Medium 5.0
    CVE-2026-27883

    Coolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosure

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the `GET /api/v1/deployments/{uuid}` endpoint allows any authenticated user to access deployment details belonging to any team, bypass…

    coollabsio coolify
  • Medium 4.3
    CVE-2026-27956

    Coolify: Cross-team application domain enumeration via domains_by_server endpoint

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, `GET /api/v1/servers/{server_uuid}/domains?uuid={app_uuid}` bypasses team scoping when the optional uuid query parameter is provided. …

    coollabsio coolify

Revision history

  1. #3

    Referenz(en) aufgenommen: EUVD-2026-40333, EUVD-2026-40332, EUVD-2026-40331

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-40225, EUVD-2026-40224, EUVD-2026-40223, EUVD-2026-40236

  3. #1

    Initiale Fassung

References