CVE-2026-34198
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In Coolify prior to 4.0.0-beta.471, the TrustProxies middleware trusts all proxies, accepting X-Forwarded-Host from any source. TrustHosts has a circular caching dependency preventing host validation. An unauthenticated attacker can trigger a password reset and intercept the link with a spoofed domain, stealing the token and taking over the account.
Risk Assessment
The risk is account takeover by an unauthenticated attacker, potentially leading to unauthorized access to managed servers, applications, and databases.
Recommendation
Immediately upgrade Coolify to version 4.0.0-beta.471 or later, which fixes the vulnerability by correcting TrustProxies and TrustHosts configuration.
Original NVD description (English source)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the TrustProxies middleware trusts all proxies ($proxies = '*'), accepting X-Forwarded-Host from any source. The TrustHosts middleware, intended to prevent host header attacks, has a circular caching dependency that prevents it from ever validating hosts. When a password reset is requested, the ResetPassword notification generates the reset URL using url(route(..., false)), which derives the host from the (spoofable) request. An unauthenticated attacker can trigger a password reset email containing a link pointing to an attacker-controlled domain, enabling token theft and account takeover. This issue is fixed in version 4.0.0-beta.471.