What’s Vulnerable › Products
coollabsio coolify vulnerabilities
78 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 78 published in the last 12 months.
Check whether your coollabsio coolify version is affected
Latest coollabsio coolify vulnerabilities
- CVE-2026-100746 — coollabsio Coolify GitHub App Setup redirect missing authentication (CVSS 7.3)
- CVE-2026-100744 — coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization (CVSS 7.3)
- CVE-2026-86117 — Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching (CVSS 8.1)
- CVE-2026-84694 — Coolify before 4.2.0 Remote Code Execution via Environment Variable Key (CVSS 8.8)
- CVE-2026-15507 — coollabsio Coolify Policy Policies authorization (CVSS 6.3)
- CVE-2026-59734 — Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution (CVSS 8.8)
- CVE-2026-42201 — Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands (CVSS 3.3)
- CVE-2026-34158 — Coolify: Command injection via single-quote breakout in Docker Compose custom commands (CVSS 8.8)
- CVE-2026-42200 — Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE (CVSS 8.8)
- CVE-2026-42172 — Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Access (CVSS 3.1)
- CVE-2026-42147 — Coolify: SSRF via S3 Storage Endpoint in testConnection() (CVSS 4.9)
- CVE-2026-42145 — Coolify: File Upload Without Type or Size Validation in Database Backup Restore (CVSS 3.1)
- CVE-2026-42143 — Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers (CVSS 8.8)
- CVE-2026-34198 — Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing (CVSS 5.3)
- CVE-2026-34171 — Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value (CVSS 8.0)
- CVE-2026-34170 — Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL (CVSS 4.3)
- CVE-2026-34168 — Coolify: Command injection via unsanitized persistent storage name in docker volume commands (CVSS 8.8)
- CVE-2026-34152 — Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport) (CVSS 8.8)
- CVE-2026-34149 — Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs (CVSS 3.3)
- CVE-2026-34058 — Coolify: OS Command Injection via Unmanaged Container Operations - Remote Code Execution (CVSS 8.8)
- CVE-2026-34057 — Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name (CVSS 8.8)
- CVE-2026-34048 — Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers (CVSS 9.9)
- CVE-2026-34047 — Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution (CVSS 9.9)
- CVE-2026-34044 — Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped) (CVSS 7.7)
- CVE-2026-34037 — Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo() (CVSS 9.9)