Coollabsio vulnerabilities
76 CVEs and advisories name Coollabsio as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-121587Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints
- CVE-2026-100746coollabsio Coolify GitHub App Setup redirect missing authentication
- CVE-2026-100744coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization
- CVE-2026-86117Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching
- CVE-2026-84694Coolify before 4.2.0 Remote Code Execution via Environment Variable Key
- CVE-2026-15507coollabsio Coolify Policy Policies authorization
- CVE-2026-59734Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution
- CVE-2026-42201Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands
- CVE-2026-34158Coolify: Command injection via single-quote breakout in Docker Compose custom commands
- CVE-2026-34170Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL
- CVE-2026-34037Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()
- CVE-2026-34048Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers
- CVE-2026-34057Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name
- CVE-2026-42143Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers
- CVE-2026-42147Coolify: SSRF via S3 Storage Endpoint in testConnection()
- CVE-2026-34044Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped)
- CVE-2026-34152Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport)
- CVE-2026-34149Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs
- CVE-2026-34171Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value
- CVE-2026-34034Coolify: Host RCE via Sentinel token injection
- CVE-2026-34168Coolify: Command injection via unsanitized persistent storage name in docker volume commands
- CVE-2026-42145Coolify: File Upload Without Type or Size Validation in Database Backup Restore
- CVE-2026-34198Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing
- CVE-2026-34058Coolify: OS Command Injection via Unmanaged Container Operations - Remote Code Execution
- CVE-2026-34035Coolify: Host RCE via Log Drain secret/env command injection
- CVE-2026-34047Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution
- CVE-2026-42172Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Access
- CVE-2026-42200Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE
- CVE-2026-42153Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container
- CVE-2026-34167Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor