CVE-2026-100746

In Coolify prior to version 4.0.0-beta.471, terminal websocket bootstrap routes only check authentication and do not enforce terminal authorization. This allows a low-privileged team member to connect to terminal routes and execute commands on team servers.

In Coolify prior to version 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the expected authorization middleware, allowing an authenticated user to access terminal functionality for resources outside the authorized scope and potentially execute commands.

Coolify prior to version 4.0.0-beta.464 has a vulnerability in the cloneTo() Livewire action in ResourceOperations.php. The authorization only checks the source resource, but destination resources are resolved using unscoped Eloquent lookups, allowing an authenticated user to clone resources into destinations owned by other teams and access cross-tenant resources.

Coolify prior to version 4.0.0-beta.469 contains an authenticated remote command injection vulnerability in application deployment handling. An authenticated user with application write permissions can exploit fields like dockerfile_location and deployment commands to achieve remote code execution and exfiltrate sensitive environment variables through deployment logs.

Coolify prior to version 4.0.0-beta.474 has a vulnerability where Livewire web UI components accept server_id and destination_uuid from URL query parameters without team ownership validation. This allows cross-team resource deployment on servers belonging to other teams.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434, low privileged users are able to see the private key of the root user on the Coolify instance. This allows them to ssh to the server and authenticate as root user, using the private key. As of time of publication, it is unclear if a patch is available.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in commands. If a victim user creates an application from an attacker repository (using build pack "docker compose"), the attacker can execute commands on the Coolify instance as root. Version 4.0.0-beta.445 fixes the issue.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, the Git Repository field during project creation is vulnerable to command injection. User input is not properly sanitized, allowing attackers to inject arbitrary shell commands that execute on the underlying server during the deployment workflow. A regular member user can exploit this vulnerability. Version 4.0.0-beta.420.7 contains a patch for the issue.

A stored XSS vulnerability in Coolify versions prior to v4.0.0-beta.420.6 allows an authenticated low-privileged user to inject malicious JavaScript into a project name. The payload executes in the admin's browser when attempting to delete the project or its associated resource.

A flaw has been found in coollabsio Coolify up to 4.1.2 in an unknown function of app/Http/Middleware/CanUpdateResource.php in the Route-Level Middleware component. Manipulation can lead to missing authorization, and the attack can be launched remotely. The exploit has been published and may be used.