coolify
- Software type
- Container platform
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/09/2026, coolify recorded 5 security vulnerabilities in the last 90 days, of which 2 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of coolify and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-121587Coolify before 4.1.1 Application Name Enumeration via Manual Webhook EndpointsCVE-2026-100746coollabsio Coolify GitHub App Setup redirect missing authenticationCVE-2026-100744coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorizationCVE-2026-86117Coolify through 4.3.17 OAuth Account Takeover via Unverified Email MatchingCVE-2026-84694Coolify before 4.2.0 Remote Code Execution via Environment Variable Key| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-121587Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints | Exploitation statusNot confirmed | FixYes |
| SeverityMedium |
CVE-2026-100746coollabsio Coolify GitHub App Setup redirect missing authentication | Exploitation statusActively exploited | FixYes | Published09/27/2026 | SeverityMedium |
|---|
CVE-2026-100744coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization | Exploitation statusActively exploited | FixYes | Published09/27/2026 | SeverityMedium |
|---|
CVE-2026-86117Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching | Exploitation statusNot exploited | FixYes | Published09/05/2026 | SeverityCritical |
|---|
CVE-2026-84694Coolify before 4.2.0 Remote Code Execution via Environment Variable Key | Exploitation statusNot exploited | FixYes | Published09/02/2026 | SeverityHigh |
|---|
CVE-2026-15507coollabsio Coolify Policy Policies authorization | Exploitation statusActively exploited | FixNo | Published07/12/2026 | SeverityMedium |
|---|
CVE-2026-59734Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution | Exploitation statusActively exploited | FixYes | Published07/09/2026 | SeverityHigh |
|---|
CVE-2026-42201Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands | Exploitation statusActively exploited | FixYes | Published07/07/2026 | SeverityLow |
|---|
CVE-2026-42200Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE | Exploitation statusActively exploited | FixYes | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-42172Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Access | Exploitation statusActively exploited | FixYes | Published07/07/2026 | SeverityLow |
|---|
CVE-2026-42147Coolify: SSRF via S3 Storage Endpoint in testConnection() | Exploitation statusActively exploited | FixYes | Published07/07/2026 | SeverityMedium |
|---|
CVE-2026-42145Coolify: File Upload Without Type or Size Validation in Database Backup Restore | Exploitation statusNot exploited | FixYes | Published07/07/2026 | SeverityLow |
|---|
CVE-2026-42143Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers | Exploitation statusActively exploited | FixYes | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-34198Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing | Exploitation statusActively exploited | FixYes | Published07/07/2026 | SeverityMedium |
|---|
CVE-2026-34171Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value | Exploitation statusNot exploited | FixYes | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-34170Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL | Exploitation statusActively exploited | FixYes | Published07/07/2026 | SeverityMedium |
|---|
CVE-2026-34168Coolify: Command injection via unsanitized persistent storage name in docker volume commands | Exploitation statusActively exploited | FixYes | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-34158Coolify: Command injection via single-quote breakout in Docker Compose custom commands | Exploitation statusActively exploited | FixYes | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-34152Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport) | Exploitation statusNot exploited | FixYes | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-34149Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs | Exploitation statusActively exploited | FixYes | Published07/07/2026 | SeverityLow |
|---|
CVE-2026-34058Coolify: OS Command Injection via Unmanaged Container Operations - Remote Code Execution | Exploitation statusActively exploited | FixYes | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-34057Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name | Exploitation statusActively exploited | FixYes | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-34048Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers | Exploitation statusActively exploited | FixYes | Published07/07/2026 | SeverityCritical |
|---|
CVE-2026-34047Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution | Exploitation statusActively exploited | FixYes | Published07/07/2026 | SeverityCritical |
|---|
CVE-2026-34044Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped) | Exploitation statusNot exploited | FixYes | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-34037Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo() | Exploitation statusActively exploited | FixYes | Published07/07/2026 | SeverityCritical |
|---|
CVE-2026-34035Coolify: Host RCE via Log Drain secret/env command injection | Exploitation statusActively exploited | FixYes | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-34034Coolify: Host RCE via Sentinel token injection | Exploitation statusNot exploited | FixYes | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-42204Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root | Exploitation statusActively exploited | FixYes | Published07/06/2026 | SeverityHigh |
|---|
CVE-2026-42153Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container | Exploitation statusActively exploited | FixYes | Published07/06/2026 | SeverityHigh |
|---|
CVE-2026-42148Coolify: Command Injection via Unescaped Version String in Docker Build | Exploitation statusActively exploited | FixYes | Published07/06/2026 | SeverityLow |
|---|
CVE-2026-41899Coolify unauthenticated feedback endpoint allows Discord webhook abuse | Exploitation statusActively exploited | FixYes | Published07/06/2026 | SeverityMedium |
|---|
CVE-2026-34599Coolify: Authenticated Remote Code Execution in GetLogs Livewire Component | Exploitation statusActively exploited | FixYes | Published07/06/2026 | SeverityHigh |
|---|
CVE-2026-34167Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor | Exploitation statusActively exploited | FixYes | Published07/06/2026 | SeverityMedium |
|---|
CVE-2026-34153Coolify LocalFileVolume fs_path command injection enables RCE | Exploitation statusNot exploited | FixYes | Published07/06/2026 | SeverityHigh |
|---|
CVE-2026-34050Coolify Settings/Updates Livewire component missing instance administrator authorization | Exploitation statusNot exploited | FixYes | Published07/06/2026 | SeverityMedium |
|---|
CVE-2026-34049Coolify: Command Injection via unsanitized MongoDB collection names in database backup | Exploitation statusActively exploited | FixYes | Published07/06/2026 | SeverityLow |
|---|
CVE-2026-34038Coolify authenticated remote command injection leading to RCE and secret exfiltration | Exploitation statusActively exploited | FixYes | Published07/06/2026 | SeverityCritical |
|---|
CVE-2026-32718Coolify read-scoped API tokens can perform state-changing validation operations | Exploitation statusActively exploited | FixYes | Published07/06/2026 | SeverityMedium |
|---|
CVE-2026-27957Coolify: Authenticated RCE via command injection in CA certificate management feature | Exploitation statusActively exploited | FixYes | Published06/30/2026 | SeverityHigh |
|---|
CVE-2026-27956Coolify: Cross-team application domain enumeration via domains_by_server endpoint | Exploitation statusNot exploited | FixYes | Published06/30/2026 | SeverityMedium |
|---|
CVE-2026-27955Coolify: Command Injection via Single-Quote Breakout in `executeInDocker()` | Exploitation statusActively exploited | FixYes | Published06/30/2026 | SeverityMedium |
|---|
CVE-2026-27883Coolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosure | Exploitation statusActively exploited | FixYes | Published06/30/2026 | SeverityMedium |
|---|
CVE-2026-27882Coolify: Timing Attack in GitLab Webhook Token Validation | Exploitation statusActively exploited | FixYes | Published06/30/2026 | SeverityMedium |
|---|
CVE-2026-27881Coolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR) | Exploitation statusActively exploited | FixYes | Published06/30/2026 | SeverityMedium |
|---|
CVE-2026-57498Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers | Exploitation statusActively exploited | FixYes | Published06/29/2026 | SeverityCritical |
|---|
CVE-2026-41896Coolify: Unauthenticated Deployment Trigger via Webhook HMAC Bypass with Null Secret | Exploitation statusActively exploited | FixYes | Published06/29/2026 | SeverityHigh |
|---|
CVE-2026-34597Coolify: Authenticated Host RCE | Exploitation statusActively exploited | FixYes | Published06/29/2026 | SeverityHigh |
|---|
CVE-2026-34594Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management | Exploitation statusActively exploited | FixYes | Published06/29/2026 | SeverityHigh |
|---|
CVE-2026-34592Coolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and Infrastructure | Exploitation statusNot exploited | FixYes | Published06/29/2026 | SeverityHigh |
|---|
76 Results | Page 1 of 2