DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Coolify: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-07-02
Ein Angreifer kann mehrere Schwachstellen in Coolify ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, um falsche Informationen darzustellen, um Dateien zu manipulieren, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.
01
beschreibt (34)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-59734US | — | Exploit | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, Coolify's app/Jobs/ApplicationDeploymentJob.php generat… | ||||
| CVE-2026-42201US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, database credential fields (redis_password, keydb_passw… | ||||
| CVE-2026-34158US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, the executeInDocker() helper wraps user-controlled comm… | ||||
| CVE-2026-42200US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL initialization script (generate_init_scripts… | ||||
| CVE-2026-42172US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Sanctum API tokens did not expire, allowing a leaked to… | ||||
| CVE-2026-42147US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, S3 storage endpoint validation only checks URL format a… | ||||
| CVE-2026-42145US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the file upload endpoint (app/Http/Controllers/UploadCo… | ||||
| CVE-2026-42143US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, user-controlled persistent volume names are interpolate… | ||||
| CVE-2026-34198US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the TrustProxies middleware trusts all proxies ($proxie… | ||||
| CVE-2026-34171US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GET /invitations/{uuid} endpoint can perform a stat… | ||||
| CVE-2026-34170US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp api_url field is used as the base URL for… | ||||
| CVE-2026-34168US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the LocalPersistentVolume.name field is interpolated di… | ||||
| CVE-2026-34152US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, pre-deployment and post-deployment commands are single-… | ||||
| CVE-2026-34149US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, DatabaseBackupJob interpolates user-controlled database… | ||||
| CVE-2026-34058US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the Livewire component Server\Resources exposes public… | ||||
| CVE-2026-34057US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the database import Livewire component (app/Livewire/Pr… | ||||
| CVE-2026-34048US | —OT erhöht | Exploit | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal websocket bootstrap routes only check authenti… | ||||
| CVE-2026-34047US | —OT erhöht | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the… | ||||
| CVE-2026-34044US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, the Logs::mount() component looks up resources by UUID… | ||||
| CVE-2026-34037US | — | — | ||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() Livewire action in ResourceOperations.php… | ||||
20 von 34 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- GitHub Security Advisory GHSA-389w-cc6x-wr2m vom 2026-07-02external
- GitHub Security Advisory GHSA-3g6r-cxv5-3c7h vom 2026-07-02external
- GitHub Security Advisory GHSA-46hp-7m8g-7622 vom 2026-07-02external
- GitHub Security Advisory GHSA-4fhp-xqqp-w7vv vom 2026-07-02external
- GitHub Security Advisory GHSA-4mpw-wcj4-v9pp vom 2026-07-02external
- GitHub Security Advisory GHSA-4vff-6j8j-qhcg vom 2026-07-02external
- GitHub Security Advisory GHSA-565g-9j4m-wqmr vom 2026-07-02external
- GitHub Security Advisory GHSA-5qp8-9gg7-4c86 vom 2026-07-02external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan