Summary
Ein Angreifer kann mehrere Schwachstellen in Coolify ausnutzen, um beliebigen Code mit Root-Rechten auszuführen und vertrauliche Informationen offenzulegen.
Product
Coolify ist eine Open-Source-Plattform zur Vereinfachung der Bereitstellung und Verwaltung von Anwendungen.
Vulnerabilities 2
-
High 8.8
Coolify: Authenticated RCE via command injection in CA certificate management feature
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, an authenticated command injection vulnerability in the CA Certificate management feature allows any authenticated user to execute arb…
-
Medium 4.8
Coolify: Timing Attack in GitLab Webhook Token Validation
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.461, the GitLab webhook endpoint uses a non-constant-time string comparison operator (!==) to validate the webhook secret token. This imple…
Revision history
-
#1
Initiale Fassung
References
-
Coolify Security Advisory vom 2026-06-30
https://github.com/coollabsio/coolify/security/advisories/GHSA-x525-46rq-mr8c
-
Coolify Security Advisory vom 2026-06-30
https://github.com/coollabsio/coolify/security/advisories/GHSA-7g97-c4xv-3cjx