Coolify CVE-2026-121587

No special conditions beyond the product exposing its manual webhook endpoints, which exist by default in affected Coolify versions (before 4.1.1): remote unauthenticated attackers reach the GitHub/GitLab/Bitbucket/Gitea manual webhook routes and the enumeration logic runs before any signature or secret check. The attacker supplies a repository full_name of '%' or empty plus a branch value; the unescaped LIKE wildcard then matches applications regardless of team ownership. What LIMITS impact: exploitation only returns application NAMES (not source, secrets, or config), it requires that applications actually exist whose git_branch equals the submitted branch (hence attackers use common defaults like 'main'/'master'), and the instance must be running a vulnerable version (< 4.1.1) with webhook endpoints network-reachable. There is no authentication, user interaction, or non-default configuration requirement.

This is a moderate-severity information disclosure flaw (vendor CVSS 4.0 base 6.9) whose signals are internally consistent rather than conflicting. The 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) matches the description precisely: the enumeration happens on manual webhook endpoints BEFORE signature verification, so it is genuinely network-reachable and unauthenticated (PR:N confirmed). Impact is correctly capped at VC:L - only application names leak, with no integrity or availability effect (VI:N/VA:N) and no cross-system scope (SC:N/SI:N/SA:N). No EPSS score, no CISA KEV listing, and no explicit POC flag are present in the input, so exploitation probability cannot be quantified from the data. The vuln.today priority is 'this_month' rather than act_now/emergency, which aligns with a low-impact disclosure that leaks metadata (names across teams) but not credentials, source, or secrets. Net: this is a real, easily-triggered unauthenticated bug worth patching on a normal cycle, not a high-CVSS-but-illusory issue, but also not an emergency - the confidentiality blast radius is limited to application naming/structure intelligence that could feed later targeting. No key signals conflict; the main gaps are the absence of EPSS/KEV/POC telemetry (absence, not contradiction).

An unauthenticated attacker sends an HTTP POST to a Coolify instance's manual webhook endpoint (GitHub, GitLab, Bitbucket or Gitea) supplying a repository name of '%' or empty together with a common branch such as 'main'. Because the lookup used an unescaped SQL LIKE wildcard and ran before signature verification, the server returns a payload listing the names of every application matching that branch across all teams. The attacker harvests cross-team application names as reconnaissance for further targeting. No public exploit is identified in the input, though the VulnCheck advisory and the fix commit describe the exact trigger.