DeutschShown in its original language — a full translation is planned for a future version.
Coolify: Mehrere Schwachstellen
view advisory published 2026-07-02
Ein Angreifer kann mehrere Schwachstellen in Coolify ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, um falsche Informationen darzustellen, um Dateien zu manipulieren, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.
01
describes (34)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-59734US | — | Exploit | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, Coolify's app/Jobs/ApplicationDeploymentJob.php generat… | ||||
| CVE-2026-42201US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, database credential fields (redis_password, keydb_passw… | ||||
| CVE-2026-34158US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, the executeInDocker() helper wraps user-controlled comm… | ||||
| CVE-2026-42200US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL initialization script (generate_init_scripts… | ||||
| CVE-2026-42172US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Sanctum API tokens did not expire, allowing a leaked to… | ||||
| CVE-2026-42147US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, S3 storage endpoint validation only checks URL format a… | ||||
| CVE-2026-42145US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the file upload endpoint (app/Http/Controllers/UploadCo… | ||||
| CVE-2026-42143US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, user-controlled persistent volume names are interpolate… | ||||
| CVE-2026-34198US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the TrustProxies middleware trusts all proxies ($proxie… | ||||
| CVE-2026-34171US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GET /invitations/{uuid} endpoint can perform a stat… | ||||
| CVE-2026-34170US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp api_url field is used as the base URL for… | ||||
| CVE-2026-34168US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the LocalPersistentVolume.name field is interpolated di… | ||||
| CVE-2026-34152US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, pre-deployment and post-deployment commands are single-… | ||||
| CVE-2026-34149US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, DatabaseBackupJob interpolates user-controlled database… | ||||
| CVE-2026-34058US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the Livewire component Server\Resources exposes public… | ||||
| CVE-2026-34057US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the database import Livewire component (app/Livewire/Pr… | ||||
| CVE-2026-34048US | —OT elevated | Exploit | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal websocket bootstrap routes only check authenti… | ||||
| CVE-2026-34047US | —OT elevated | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the… | ||||
| CVE-2026-34044US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, the Logs::mount() component looks up resources by UUID… | ||||
| CVE-2026-34037US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() Livewire action in ResourceOperations.php… | ||||
showing 20 of 34
02
references
External citations — patches, advisories, analysis.
- GitHub Security Advisory GHSA-389w-cc6x-wr2m vom 2026-07-02external
- GitHub Security Advisory GHSA-3g6r-cxv5-3c7h vom 2026-07-02external
- GitHub Security Advisory GHSA-46hp-7m8g-7622 vom 2026-07-02external
- GitHub Security Advisory GHSA-4fhp-xqqp-w7vv vom 2026-07-02external
- GitHub Security Advisory GHSA-4mpw-wcj4-v9pp vom 2026-07-02external
- GitHub Security Advisory GHSA-4vff-6j8j-qhcg vom 2026-07-02external
- GitHub Security Advisory GHSA-565g-9j4m-wqmr vom 2026-07-02external
- GitHub Security Advisory GHSA-5qp8-9gg7-4c86 vom 2026-07-02external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan