CVE-2026-41896

CVE-2026-41896 affects Coolify prior to 4.0.0-beta.474. The HMAC key used to validate webhook requests (manual_webhook_secret_github) is nullable with no default, so new apps have a null secret. PHP’s hash_hmac() coerces a null key to an empty string, causing the server to compute hash_hmac('sha2...

CVE-2026-41896 Coolify: Unauthenticated Deployment Trigger via Webhook HMAC Bypass with Null Secret

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the HMAC key is the application's manualwebhooksecretgithub field, which is used by Coolify's webhook endpoints to validate incoming requests, is nullable with no default —...