CVE-2026-27882: Coolify: Timing Attack in GitLab Webhook Token Validation

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-30 · updated 2026-10-25
Weakness: CWE-208

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.461, the GitLab webhook endpoint uses a non-constant-time string comparison operator (!==) to validate the webhook secret token. This implementation is vulnerable to timing attacks, which could allow an attacker to gradually discover the secret token by measuring response time differences. This vulnerability is fixed in 4.0.0-beta.461.

Affected products

coollabsio coolify: before 4.0.0-beta.461

References

https://github.com/coollabsio/coolify/security/advisories/GHSA-x525-46rq-mr8c
https://github.com/coollabsio/coolify/security/advisories/GHSA-x525-46rq-mr8c

Get alerted when CVE-2026-27882 or the next vulnerability affects your stack