Coolify vulnerabilities

Coolify is an open-source tool for managing servers, applications, and databases. In versions up to and including v4.0.0-beta.434, an attacker can initiate a password reset for a victim and modify the Host header to a malicious value. The victim receives a password reset email with a link to the malicious host, and if clicked, the reset token is sent to the attacker's server, allowing account takeover.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a command injection vulnerability exists in the git source input fields of a resource, allowing a low privileged user (member) to execute system commands as root on the Coolify instance. As of time of publication, it is unclear if a patch is available.

Coolify is an open-source tool for managing servers, applications, and databases. In versions up to and including v4.0.0-beta.434, a low-privileged user (member) can view and use invitation links sent to an administrator. If they use the link before the legitimate recipient, they can log in as an administrator, resulting in privilege escalation.

Coolify up to version v4.0.0-beta.434 contains a vulnerability that allows a low-privileged user (member) to invite a high-privileged user (administrator). Although the first invitation attempt fails with an error, clicking the invite button a second time succeeds. This enables an attacker to invite themselves as an administrator, then reset the password and log in with admin privileges.

Coolify versions up to and including v4.0.0-beta.420.6 are vulnerable to a stored XSS attack in the project creation workflow. An authenticated low-privileged user can create a project with a malicious name containing JavaScript, which executes in the admin's browser when the project or resource is deleted. Version 4.0.0-beta.420.7 contains a patch.

Coolify before version 4.0.0-beta.420.7 contains a Remote Code Execution (RCE) vulnerability in the application deployment workflow. A low-privileged member can inject arbitrary Docker Compose directives during project creation or updates, allowing to mount the host filesystem and execute commands with root privileges, bypassing container isolation.

In Coolify prior to version 4.0.0-beta.471, terminal websocket bootstrap routes only check authentication and do not enforce terminal authorization. This allows a low-privileged team member to connect to terminal routes and execute commands on team servers.

In Coolify prior to version 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the expected authorization middleware, allowing an authenticated user to access terminal functionality for resources outside the authorized scope and potentially execute commands.

Coolify prior to version 4.0.0-beta.464 has a vulnerability in the cloneTo() Livewire action in ResourceOperations.php. The authorization only checks the source resource, but destination resources are resolved using unscoped Eloquent lookups, allowing an authenticated user to clone resources into destinations owned by other teams and access cross-tenant resources.

Coolify prior to version 4.0.0-beta.469 contains an authenticated remote command injection vulnerability in application deployment handling. An authenticated user with application write permissions can exploit fields like dockerfile_location and deployment commands to achieve remote code execution and exfiltrate sensitive environment variables through deployment logs.

Coolify prior to version 4.0.0-beta.474 has a vulnerability where Livewire web UI components accept server_id and destination_uuid from URL query parameters without team ownership validation. This allows cross-team resource deployment on servers belonging to other teams.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434, low privileged users are able to see the private key of the root user on the Coolify instance. This allows them to ssh to the server and authenticate as root user, using the private key. As of time of publication, it is unclear if a patch is available.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in commands. If a victim user creates an application from an attacker repository (using build pack "docker compose"), the attacker can execute commands on the Coolify instance as root. Version 4.0.0-beta.445 fixes the issue.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, the Git Repository field during project creation is vulnerable to command injection. User input is not properly sanitized, allowing attackers to inject arbitrary shell commands that execute on the underlying server during the deployment workflow. A regular member user can exploit this vulnerability. Version 4.0.0-beta.420.7 contains a patch for the issue.

A stored XSS vulnerability in Coolify versions prior to v4.0.0-beta.420.6 allows an authenticated low-privileged user to inject malicious JavaScript into a project name. The payload executes in the admin's browser when attempting to delete the project or its associated resource.

A missing authorization vulnerability was found in Coolify up to version 4.1.1 within the Policy Handler component. An unknown function in the /app/Policies/ file can be exploited remotely without proper authentication. The exploit is publicly available.

Coolify prior to version 4.0.0-beta.469 contains a command injection vulnerability in the generate_healthcheck_commands() function. The health_check_host, health_check_method, and health_check_path parameters are directly interpolated into shell commands without proper sanitization, allowing authenticated users to execute arbitrary commands inside deployment containers.

In Coolify prior to version 4.0.0-beta.474, database credential fields (redis_password, keydb_password, dragonfly_password, clickhouse_admin_user, clickhouse_admin_password, postgres_user, mysql_user) are validated only as 'string' with no shell-safety checks. These values are then interpolated directly into Docker Compose YAML command strings without any escaping, allowing command injection.

Coolify prior to version 4.0.0-beta.469 has a vulnerability in the executeInDocker() helper that wraps user-controlled commands in single quotes without escaping embedded single quotes. Attackers who can edit application settings can inject a single quote into docker_compose_custom_build_command or docker_compose_custom_start_command to break out of the quoted context and execute arbitrary commands on the managed server host during deployments, escaping the intended Docker container confinement.

Coolify prior to version 4.0.0-beta.474 has a vulnerability in the PostgreSQL initialization script that allows an authenticated user to write files outside the intended directory and achieve command execution through database initialization.

In Coolify prior to version 4.0.0-beta.474, Sanctum API tokens did not expire, meaning a leaked token retained access indefinitely until manually revoked. This vulnerability is fixed in version 4.0.0-beta.474.

Coolify prior to version 4.0.0-beta.474 has a vulnerability where S3 storage endpoint validation only checks URL format, and testConnection() sends a server-side request to the configured endpoint. This allows an authenticated user with storage management permissions to make Coolify request internal or metadata-service URLs.

In Coolify prior to version 4.0.0-beta.474, the file upload endpoint for database backup restore did not enforce file type or size validation. This allowed an authenticated user to upload unexpected or oversized files that could affect service availability.

Coolify prior to version 4.0.0-beta.471 has a vulnerability where user-controlled persistent volume names are interpolated into shell commands executed on managed servers without escaping or validation. This allows an authenticated member to inject shell metacharacters and execute commands as root when volume operations are triggered.

In Coolify prior to 4.0.0-beta.471, the TrustProxies middleware trusts all proxies, accepting X-Forwarded-Host from any source. TrustHosts has a circular caching dependency preventing host validation. An unauthenticated attacker can trigger a password reset and intercept the link with a spoofed domain, stealing the token and taking over the account.

In Coolify prior to version 4.0.0-beta.471, the GET /invitations/{uuid} endpoint can perform a state-changing password reset using an attacker-known invitation UUID. An attacker who can cause a victim to visit the crafted invitation URL can reset the victim's account password to a predictable value.

A vulnerability in Coolify prior to version 4.0.0-beta.471 allows an authenticated user to configure a GitHub App source with an api_url field used as the base URL for server-side HTTP requests without private IP or cloud metadata endpoint blocking. This enables requests to internal services or cloud metadata endpoints.

Coolify prior to version 4.0.0-beta.471 contains a shell command injection vulnerability. The LocalPersistentVolume.name field is interpolated directly into docker volume shell commands without proper shell argument escaping, allowing an authenticated user to execute arbitrary commands on managed servers when the resource is deleted.

In Coolify prior to version 4.0.0-beta.471, pre-deployment and post-deployment commands are single-quote escaped but then sent through SSH heredoc transport that preserves newlines, allowing an authenticated user to inject additional shell statements that execute on the remote server during deployment.

Coolify prior to version 4.0.0-beta.471 contains a command injection vulnerability in the DatabaseBackupJob function. An authenticated user with database management permissions can execute arbitrary commands on managed servers by manipulating database credentials or MongoDB collection exclusion names.

In Coolify prior to version 4.0.0-beta.471, the Livewire component Server\Resources exposes public methods (startUnmanaged, stopUnmanaged, restartUnmanaged) that accept a container ID parameter directly from the browser without sanitization. This parameter is interpolated into shell commands executed via SSH on managed servers, allowing any authenticated team member to execute arbitrary OS commands on remote servers.

Coolify prior to 4.0.0-beta.471 has a vulnerability in the database import Livewire component that allows an authenticated user to inject commands via the database import container name. Lack of locking and validation lets client-controlled container and server properties reach shell commands.

In Coolify prior to version 4.0.0-beta.466, the Logs::mount() component looks up resources by UUID without scoping the lookup to the current team, allowing an authenticated user to access logs for applications owned by other teams by supplying a victim resource UUID.

Coolify prior to version 4.0.0-beta.466 has a vulnerability where log drain secrets and environment values are interpolated into shell commands without proper encoding. This allows an authenticated user to inject commands executed on the host.

Coolify prior to version 4.0.0-beta.466 has a vulnerability due to insufficient validation of the sentinel_token setting used in shell commands. An authenticated user with access to server Sentinel settings can inject shell syntax and execute commands on the host when Sentinel is restarted.

In Coolify from version 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELL_SAFE_COMMAND_PATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-deployment command fields, allowing an authenticated team member to inject shell commands that execute on the host.

Coolify prior to version 4.0.0-beta.474 contains a command injection vulnerability in the PostgreSQL healthcheck command generation. An authenticated attacker can exploit attacker-controlled database settings (postgres_user and postgres_db) to inject arbitrary commands executed in the database container.

A vulnerability in Coolify prior to version 4.0.0-beta.474 allows arbitrary command execution on the server due to missing shell escaping in the buildHelperImage method. An attacker can set the dev_helper_version field and trigger the helper image build in a development environment.

In Coolify prior to version 4.0.0-beta.474, the POST /api/feedback endpoint lacks authentication, rate limiting, and input validation. This allows arbitrary content to be forwarded directly to a Discord webhook, enabling spam, content injection, and webhook abuse.

In Coolify prior to version 4.0.0-beta.471, an authenticated command injection vulnerability exists in the GetLogs Livewire component. Users with team membership (lowest privilege member role) can execute arbitrary commands as root on managed servers.

In Coolify prior to version 4.0.0-beta.471, the ActivityMonitor Livewire component exposes a public $activityId property without the #[Locked] attribute. This allows an authenticated user to enumerate activity records across all teams and read the full command output from remote SSH processes, potentially revealing secrets, configuration files, and infrastructure details.

In Coolify prior to version 4.0.0-beta.471, LocalFileVolume::saveStorageOnServer builds shell commands using unescaped fs_path and parent_dir values before validation, and submitFileStorage does not validate the user-controlled file-mount path before creating a volume. This allows an authenticated user who can add file storage to execute commands when the storage is saved.

In Coolify prior to version 4.0.0-beta.471, the Settings/Updates Livewire component does not check isInstanceAdmin in its mount method, allowing non-admin users to access the Updates settings page and potentially modify auto-update settings or trigger update checks.

In Coolify from version 4.0.0-beta.451 through 4.0.0-beta.470, database backup handling for MongoDB collection names did not fully validate shell metacharacters, allowing a highly privileged attacker who can configure backup inputs to inject commands. This issue is fixed in version 4.0.0-beta.471.

Coolify prior to version 4.0.0-beta.466 has a vulnerability where mutating API validation endpoints are guarded only by read ability. This allows read-scoped API tokens to perform state-changing operations such as validating cloud tokens and servers.

In Coolify prior to version 4.0.0-beta.464, an authenticated command injection vulnerability in the CA Certificate management feature allows any authenticated user to execute arbitrary commands as the configured SSH user on the managed server host.

Coolify prior to version 4.0.0-beta.464 has a vulnerability in the `GET /api/v1/servers/{server_uuid}/domains?uuid={app_uuid}` endpoint that bypasses team scoping when the optional `uuid` parameter is provided. Any authenticated API user can enumerate domain names (FQDNs) of applications belonging to other teams.

Coolify prior to version 4.0.0-beta.464 has a vulnerability in the executeInDocker() helper that wraps commands in bash -c without escaping single quotes. The docker_compose_custom_build_command and docker_compose_custom_start_command fields are interpolated directly, allowing an attacker to break out of the bash -c argument and execute arbitrary commands on the managed server host.

Coolify prior to version 4.0.0-beta.464 has a vulnerability in the GET /api/v1/deployments/{uuid} endpoint that allows any authenticated user to access deployment details of any team, bypassing team-based authorization. The issue stems from the $teamId extracted from the authentication token not being used to scope the database query.

Coolify prior to version 4.0.0-beta.461 uses a non-constant-time string comparison operator (!==) to validate the GitLab webhook secret token. This allows an attacker to gradually discover the secret token by measuring response time differences (timing attack).