Coollabsio vulnerabilities
76 CVEs and advisories name Coollabsio as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-34049Coolify: Command Injection via unsanitized MongoDB collection names in database backup
- CVE-2026-34599Coolify: Authenticated Remote Code Execution in GetLogs Livewire Component
- CVE-2026-42204Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root
- CVE-2026-42148Coolify: Command Injection via Unescaped Version String in Docker Build
- CVE-2026-34153Coolify LocalFileVolume fs_path command injection enables RCE
- CVE-2026-41899Coolify unauthenticated feedback endpoint allows Discord webhook abuse
- CVE-2026-34050Coolify Settings/Updates Livewire component missing instance administrator authorization
- CVE-2026-32718Coolify read-scoped API tokens can perform state-changing validation operations
- CVE-2026-34038Coolify authenticated remote command injection leading to RCE and secret exfiltration
- CVE-2026-27957Coolify: Authenticated RCE via command injection in CA certificate management feature
- CVE-2026-27956Coolify: Cross-team application domain enumeration via domains_by_server endpoint
- CVE-2026-27955Coolify: Command Injection via Single-Quote Breakout in `executeInDocker()`
- CVE-2026-27883Coolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosure
- CVE-2026-27881Coolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR)
- CVE-2026-27882Coolify: Timing Attack in GitLab Webhook Token Validation
- CVE-2026-34592Coolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and Infrastructure
- CVE-2026-34594Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management
- CVE-2026-34597Coolify: Authenticated Host RCE
- CVE-2026-41896Coolify: Unauthenticated Deployment Trigger via Webhook HMAC Bypass with Null Secret
- CVE-2026-57498Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers
- CVE-2026-12815coollabsio coolify Image Name os command injection
- CVE-2025-64425Coolify has host header injection in forgot password
- CVE-2025-64424Colify has command injection vulnerability in project git source
- CVE-2025-64423Coolify has a Privilege Escalation - low privileged users can see and use admin invitation links
- CVE-2025-64422Rate-limit bypass on login via X-Forwarded-Host header
- CVE-2025-64421Coolify has a privilege escalation - low privileged user can invite themselves as an admin user
- CVE-2025-64420Coolify members can see private key of root user
- CVE-2025-64419Coolify vulnerable to command injection via docker-compose.yaml parameters
- CVE-2025-59955Coolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpoint
- CVE-2025-59158Coolify has Stored XSS in Project Name