Coolify CVE-2026-100746

Reachable on the unauthenticated GET callback /webhooks/source/github/redirect (Github::redirect) in Coolify up to 4.1.0. The attacker must supply a 'state' value equal to an existing GithubApp UUID and a 'code' for GitHub App manifest conversion; success overwrites that App's stored credentials because the pre-patch code performed no authenticated-user, current-team ownership, or already-configured check. Limiting factors: the GitHub App UUID is a random identifier the attacker must know or discover, and the target App must exist (typically mid-setup), which meaningfully raises attack complexity above the vendor's AC:L rating. No user interaction and no authentication are required once a valid UUID is known.

This is a genuine but moderate-severity issue. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VC:L/VI:L/VA:L, E:P) rates it 6.9, driven by unauthenticated network reachability with low impact across all three dimensions. CWE-306 (missing authentication) is confirmed by the source diff: the pre-patch Github::redirect handler resolved a GitHub App purely by attacker-supplied 'state' UUID (GithubApp::where('uuid',$state)->firstOrFail()) with no authenticated-user, team-ownership, or already-configured guard, letting an unauthenticated request overwrite an existing GitHub App's credentials (client_id/client_secret/webhook_secret/private_key). POC=YES (public exploit archive), so 'publicly available exploit code exists', but there is no CISA KEV listing and no EPSS score in the input, so there is no evidence of active exploitation - treat the public POC and actual exploitation as distinct signals. Practical exploitation is gated by needing to reference an existing GitHub App by its random UUID during an in-flight setup, which is why the vendor's AC:L is arguably generous - knowing/guessing that UUID raises real-world complexity (see assessed vector). SSVC-style read: exploitation=public-PoC, automatable=partial (UUID discovery limits mass automation), technical impact=partial. Net: a real fix-worthy flaw for Coolify operators, not an emergency-tier internet-wide risk.

An attacker who learns or observes a Coolify instance's in-progress GitHub App UUID sends a crafted unauthenticated GET to /webhooks/source/github/redirect with that UUID as 'state' and their own GitHub App manifest 'code', causing Coolify to fetch and persist attacker-controlled GitHub App credentials over the victim's record. A public proof-of-concept exists (the 'coolify-unauth-secret-overwrite-github-app-redirect' archive). Because AV:N/PR:N applies, no authentication is needed, though the attacker must target a valid App UUID.