CVE-2026-34038

CVE-2026-34038: Authenticated Remote Command Injection in Coolify This repository contains documentation and analysis for CVE-2026-34038 , a critical command injection vulnerability in Coolify. Summary An authenticated remote command injection vulnerability CWE-78 in Coolify allows users with...

CVE-2025-64424-Coolify-

Coolify CVE-2025-64424 RCE Vulnerability Lab Lesson Plan: Red74-Coolio-CVE-2025-64424 Disclaimer: This repository contains a deliberately vulnerable version of Coolify and is intended for educational purposes, CTF environments, and cybersecurity training. Do not deploy this in a production...

CVE-2025-34159

CVE-2025-34159: Docker Compose Injection in Coolify Vulnerability Overview Field| Value ---|--- CVE ID| CVE-2025-34159 Affects| Coolify ≤ v4.0.0-beta.420.6 Fixed in| v4.0.0-beta.420.7 Severity| Critical CVSS 4.0| CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CWE| CWE-78 OS Comma...

CVE-2026-34048

CVE-2026-34048 Admin-only terminal bootstrap routes checked only for login state, which let a normal team member drive Coolify's realtime terminal backend and execute commands on team servers. Intro I found this issue while reviewing Coolify , an open-source self-hosted PaaS, with a very direct...

coolify-cve-2025-66209-66213

Coolify Security Advisories - CVE-2025-66209 through CVE-2025-66213 Reporter: 0xrakan Vendor: coollabsio/coolify Affected Versions: v4.0.0-beta.451 Fixed Version: v4.0.0-beta.451 Severity: Critical CVSS 9.4 Overview Five critical authenticated command injection vulnerabilities were discovered in...

CVE-2026-59734-POC

Hacker Glitch 🚨 CVE-2026-59734 — Coolify RCE Exploit OS Command Injection in Health Check → Remote Code Execution Proof-of-Concept exploit for OS Command Injection in Coolify's health check configuration. Any authenticated user could execute arbitrary commands inside deployed containers. 🎯 About...

CVE-2025-34157

Stored XSS in Coolify delete flow CVE-2025-34157 Affects: Coolify ≤ v4.0.0-beta.420.6 Fixed in: v4.0.0-beta.420.7 Severity: Critical 9.4 CVSS 4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CWE: CWE-79 Cross-Site Scripting, CWE-20 Improper Input Validation Summary A...

CVE-2026-100746

A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App Setup Handler. The manipulation of the argument state results in missing authentication. The attack can be executed...

CVE-2026-100746

A vulnerability exists in coollabsio Coolify (versions up to 4.1.0 ) within the GitHub App Setup Handler component. Specifically, the Github::redirect function in the /webhooks/source/github/redirect file is susceptible to missing authentication due to the manipulation of the state argument. This...

CVE-2026-100746 coollabsio Coolify GitHub App Setup redirect missing authentication

A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App Setup Handler. The manipulation of the argument state results in missing authentication. The attack can be executed...

CVE-2026-100746 coollabsio Coolify GitHub App Setup redirect missing authentication

A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App Setup Handler. The manipulation of the argument state results in missing authentication. The attack can be executed...

CVE-2026-100746 coollabsio Coolify GitHub App Setup redirect missing authentication

A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App Setup Handler. The manipulation of the argument state results in missing authentication. The attack can be executed...

EUVD-2026-87884

A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App Setup Handler. The manipulation of the argument state results in missing authentication. The attack can be executed...

CVE-2026-100744

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

EUVD-2026-87817

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100744 coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100744

A flaw in coollabsio Coolify versions up to 4.1.2 within the Route-Level Middleware component leads to a missing authorization vulnerability. The issue resides in an unknown function within the app/Http/Middleware/CanUpdateResource.php file. This flaw can be triggered via a remote manipulation at...

CVE-2026-100744 coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100744 coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100746: Missing Authentication for Critical Function

A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App Setup Handler. The manipulation of the argument state results in missing authentication. The attack can be executed...