CVE-2026-42172

LowCVSS 3.1

Published: 07/07/2026(UTC)Updated: 07/07/2026(UTC)Translated: 08/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

In Coolify prior to version 4.0.0-beta.474, Sanctum API tokens did not expire, meaning a leaked token retained access indefinitely until manually revoked. This vulnerability is fixed in version 4.0.0-beta.474.

Risk Assessment

The risk is that a leaked API token can be used by an unauthorized attacker for an unlimited time, allowing access to managed servers, applications, and databases.

Recommendation

Immediately update Coolify to version 4.0.0-beta.474 or later and revoke all existing Sanctum tokens to force regeneration.

Original NVD description (English source)

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Sanctum API tokens did not expire, allowing a leaked token to retain access indefinitely until manually revoked. This issue is fixed in version 4.0.0-beta.474.