CVE-2026-42147
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Coolify prior to version 4.0.0-beta.474 has a vulnerability where S3 storage endpoint validation only checks URL format, and testConnection() sends a server-side request to the configured endpoint. This allows an authenticated user with storage management permissions to make Coolify request internal or metadata-service URLs.
Risk Assessment
The risk is a Server-Side Request Forgery (SSRF) attack, which could lead to exposure of sensitive data from internal services, such as cloud metadata, or enable further attacks on internal resources.
Recommendation
Immediately update Coolify to version 4.0.0-beta.474 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, S3 storage endpoint validation only checks URL format and testConnection() sends a server-side request to the configured endpoint, allowing an authenticated user with storage management permissions to make Coolify request internal or metadata-service URLs. This issue is fixed in version 4.0.0-beta.474.