# cve.now: Coollabsio

The newest entries naming Coollabsio as an affected vendor (up to 200), of 76 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121587](https://cve.now/CVE-2026-121587.md): Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints (CVSS 6.9)
- [CVE-2026-100746](https://cve.now/CVE-2026-100746.md): coollabsio Coolify GitHub App Setup redirect missing authentication (CVSS 6.9)
- [CVE-2026-100744](https://cve.now/CVE-2026-100744.md): coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization (CVSS 6.9)
- [CVE-2026-86117](https://cve.now/CVE-2026-86117.md): Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching (CVSS 9.2)
- [CVE-2026-84694](https://cve.now/CVE-2026-84694.md): Coolify before 4.2.0 Remote Code Execution via Environment Variable Key (CVSS 8.7)
- [CVE-2026-15507](https://cve.now/CVE-2026-15507.md): coollabsio Coolify Policy Policies authorization (CVSS 5.3)
- [CVE-2026-59734](https://cve.now/CVE-2026-59734.md): Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution (CVSS 8.8)
- [CVE-2026-42201](https://cve.now/CVE-2026-42201.md): Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands (CVSS 3.3)
- [CVE-2026-34158](https://cve.now/CVE-2026-34158.md): Coolify: Command injection via single-quote breakout in Docker Compose custom commands (CVSS 8.8)
- [CVE-2026-34170](https://cve.now/CVE-2026-34170.md): Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL (CVSS 4.3)
- [CVE-2026-34037](https://cve.now/CVE-2026-34037.md): Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo() (CVSS 9.9)
- [CVE-2026-34048](https://cve.now/CVE-2026-34048.md): Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers (CVSS 9.9)
- [CVE-2026-34057](https://cve.now/CVE-2026-34057.md): Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name (CVSS 8.8)
- [CVE-2026-42143](https://cve.now/CVE-2026-42143.md): Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers (CVSS 8.8)
- [CVE-2026-42147](https://cve.now/CVE-2026-42147.md): Coolify: SSRF via S3 Storage Endpoint in testConnection() (CVSS 4.9)
- [CVE-2026-34044](https://cve.now/CVE-2026-34044.md): Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped) (CVSS 7.7)
- [CVE-2026-34152](https://cve.now/CVE-2026-34152.md): Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport) (CVSS 8.8)
- [CVE-2026-34149](https://cve.now/CVE-2026-34149.md): Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs (CVSS 3.3)
- [CVE-2026-34171](https://cve.now/CVE-2026-34171.md): Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value (CVSS 8.0)
- [CVE-2026-34034](https://cve.now/CVE-2026-34034.md): Coolify: Host RCE via Sentinel token injection (CVSS 8.8)
- [CVE-2026-34168](https://cve.now/CVE-2026-34168.md): Coolify: Command injection via unsanitized persistent storage name in docker volume commands (CVSS 8.8)
- [CVE-2026-42145](https://cve.now/CVE-2026-42145.md): Coolify: File Upload Without Type or Size Validation in Database Backup Restore (CVSS 3.1)
- [CVE-2026-34198](https://cve.now/CVE-2026-34198.md): Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing (CVSS 5.3)
- [CVE-2026-34058](https://cve.now/CVE-2026-34058.md): Coolify: OS Command Injection via Unmanaged Container Operations - Remote Code Execution (CVSS 8.8)
- [CVE-2026-34035](https://cve.now/CVE-2026-34035.md): Coolify: Host RCE via Log Drain secret/env command injection (CVSS 8.8)
- [CVE-2026-34047](https://cve.now/CVE-2026-34047.md): Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution (CVSS 9.9)
- [CVE-2026-42172](https://cve.now/CVE-2026-42172.md): Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Access (CVSS 3.1)
- [CVE-2026-42200](https://cve.now/CVE-2026-42200.md): Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE (CVSS 8.8)
- [CVE-2026-42153](https://cve.now/CVE-2026-42153.md): Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container (CVSS 8.8)
- [CVE-2026-34167](https://cve.now/CVE-2026-34167.md): Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor (CVSS 5.0)
- [CVE-2026-34049](https://cve.now/CVE-2026-34049.md): Coolify: Command Injection via unsanitized MongoDB collection names in database backup (CVSS 3.3)
- [CVE-2026-34599](https://cve.now/CVE-2026-34599.md): Coolify: Authenticated Remote Code Execution in GetLogs Livewire Component (CVSS 8.8)
- [CVE-2026-42204](https://cve.now/CVE-2026-42204.md): Coolify: Authenticated RCE via SHELL\_SAFE\_COMMAND\_PATTERN regression → host root (CVSS 8.8)
- [CVE-2026-42148](https://cve.now/CVE-2026-42148.md): Coolify: Command Injection via Unescaped Version String in Docker Build (CVSS 3.8)
- [CVE-2026-34153](https://cve.now/CVE-2026-34153.md): Coolify LocalFileVolume fs\_path command injection enables RCE (CVSS 8.8)
- [CVE-2026-41899](https://cve.now/CVE-2026-41899.md): Coolify unauthenticated feedback endpoint allows Discord webhook abuse (CVSS 6.5)
- [CVE-2026-34050](https://cve.now/CVE-2026-34050.md): Coolify Settings/Updates Livewire component missing instance administrator authorization (CVSS 6.5)
- [CVE-2026-32718](https://cve.now/CVE-2026-32718.md): Coolify read-scoped API tokens can perform state-changing validation operations (CVSS 6.5)
- [CVE-2026-34038](https://cve.now/CVE-2026-34038.md): Coolify authenticated remote command injection leading to RCE and secret exfiltration (CVSS 9.9)
- [CVE-2026-27957](https://cve.now/CVE-2026-27957.md): Coolify: Authenticated RCE via command injection in CA certificate management feature (CVSS 8.8)
- [CVE-2026-27956](https://cve.now/CVE-2026-27956.md): Coolify: Cross-team application domain enumeration via domains\_by\_server endpoint (CVSS 4.3)
- [CVE-2026-27955](https://cve.now/CVE-2026-27955.md): Coolify: Command Injection via Single-Quote Breakout in \`executeInDocker()\` (CVSS 6.6)
- [CVE-2026-27883](https://cve.now/CVE-2026-27883.md): Coolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosure (CVSS 5.0)
- [CVE-2026-27881](https://cve.now/CVE-2026-27881.md): Coolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR) (CVSS 5.0)
- [CVE-2026-27882](https://cve.now/CVE-2026-27882.md): Coolify: Timing Attack in GitLab Webhook Token Validation (CVSS 4.8)
- [CVE-2026-34592](https://cve.now/CVE-2026-34592.md): Coolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and Infrastructure (CVSS 7.7)
- [CVE-2026-34594](https://cve.now/CVE-2026-34594.md): Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management (CVSS 8.8)
- [CVE-2026-34597](https://cve.now/CVE-2026-34597.md): Coolify: Authenticated Host RCE (CVSS 8.8)
- [CVE-2026-41896](https://cve.now/CVE-2026-41896.md): Coolify: Unauthenticated Deployment Trigger via Webhook HMAC Bypass with Null Secret (CVSS 7.5)
- [CVE-2026-57498](https://cve.now/CVE-2026-57498.md): Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server\_id and destination\_uuid — Deploy to Other Teams' Servers (CVSS 9.6)
- [CVE-2026-12815](https://cve.now/CVE-2026-12815.md): coollabsio coolify Image Name os command injection (CVSS 5.3)
- [CVE-2025-64425](https://cve.now/CVE-2025-64425.md): Coolify has host header injection in forgot password (CVSS 8.5)
- [CVE-2025-64424](https://cve.now/CVE-2025-64424.md): Colify has command injection vulnerability in project git source (CVSS 9.4)
- [CVE-2025-64423](https://cve.now/CVE-2025-64423.md): Coolify has a Privilege Escalation - low privileged users can see and use admin invitation links (CVSS 7.7)
- [CVE-2025-64422](https://cve.now/CVE-2025-64422.md): Rate-limit bypass on login via X-Forwarded-Host header (CVSS 5.5)
- [CVE-2025-64421](https://cve.now/CVE-2025-64421.md): Coolify has a privilege escalation - low privileged user can invite themselves as an admin user (CVSS 8.7)
- [CVE-2025-64420](https://cve.now/CVE-2025-64420.md): Coolify members can see private key of root user (CVSS 10.0)
- [CVE-2025-64419](https://cve.now/CVE-2025-64419.md): Coolify vulnerable to command injection via docker-compose.yaml parameters (CVSS 9.7)
- [CVE-2025-59955](https://cve.now/CVE-2025-59955.md): Coolify leaksensitive information \`email\_change\_code\` in \`/api/v1/teams/{team\_id | current}/members\` API endpoint (CVSS 5.7)
- [CVE-2025-59158](https://cve.now/CVE-2025-59158.md): Coolify has Stored XSS in Project Name (CVSS 9.4)
- [CVE-2025-59157](https://cve.now/CVE-2025-59157.md): Coolify has Git Repository RCE (CVSS 10.0)
- [CVE-2025-59156](https://cve.now/CVE-2025-59156.md): Coolify has Docker Compose Injection issue (CVSS 9.4)
- [CVE-2025-66213](https://cve.now/CVE-2025-66213.md): Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount Path (CVSS 9.4)
- [CVE-2025-66212](https://cve.now/CVE-2025-66212.md): Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration Filename (CVSS 9.4)
- [CVE-2025-66211](https://cve.now/CVE-2025-66211.md): Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename (CVSS 9.4)
- [CVE-2025-66210](https://cve.now/CVE-2025-66210.md): Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import (CVSS 9.4)
- [CVE-2025-66209](https://cve.now/CVE-2025-66209.md): Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup (CVSS 10.0)
- [CVE-2025-24025](https://cve.now/CVE-2025-24025.md): Coolify Vulnerable to Reflected XSS on Tag Search (CVSS 1.3)
- [CVE-2025-22612](https://cve.now/CVE-2025-22612.md): Coolify Vulnerable to Private Key Enumeration on Onboarding resulting in Remote Command Execution (RCE) (CVSS 10.0)
- [CVE-2025-22611](https://cve.now/CVE-2025-22611.md): Coolify vulnerable to Privilege Escalation resulting in Remote Command Execution (RCE) (CVSS 10.0)
- [CVE-2025-22610](https://cve.now/CVE-2025-22610.md): Coolify Vulnerable to OAuth Secrets Leak (CVSS 5.7)
- [CVE-2025-22609](https://cve.now/CVE-2025-22609.md): Coolify Vulnerable to Private Key Hijacking / Remote Command Execution (RCE) (CVSS 10.0)
- [CVE-2025-22608](https://cve.now/CVE-2025-22608.md): Coolify Vulnerable to Revocation of Arbitrary Team Invitations (DOS) (CVSS 6.5)
- [CVE-2025-22607](https://cve.now/CVE-2025-22607.md): Coolify Vulnerable to GitHub / GitLab OAuth Secrets Leak (CVSS 4.7)
- [CVE-2025-22606](https://cve.now/CVE-2025-22606.md): Coolify Command Injection Vulnerability in Project Name (CVSS 8.5)
- [CVE-2025-22605](https://cve.now/CVE-2025-22605.md): Coolify OS Command Injection Vulnerability in SSH Command Generation (CVSS 8.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/coollabsio
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.