EUVD-2026-40328Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-accessible endpoint requires no authentication, but AC:H reflects timing attack dependency on low-jitter, high-volume network conditions; no availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.461, the GitLab webhook endpoint uses a non-constant-time string comparison operator (!==) to validate the webhook secret token. This implementation is vulnerable to timing attacks, which could allow an attacker to gradually discover the secret token by measuring response time differences. This vulnerability is fixed in 4.0.0-beta.461.
AnalysisAI
Coolify's GitLab webhook endpoint leaks its secret token through a timing side-channel, enabling unauthenticated network attackers to reconstruct the token incrementally by measuring HTTP response time differences. All self-hosted Coolify instances prior to 4.0.0-beta.461 with GitLab webhook integrations configured are affected. Once the secret is recovered, an attacker can forge arbitrary GitLab webhook events and potentially trigger unauthorized deployments. No public exploit or active exploitation has been identified at time of analysis; the CVSS-assigned AC:H correctly reflects the practical difficulty of conducting reliable timing measurements over real-world networks.
Technical ContextAI
CWE-208 (Observable Timing Discrepancy) arises from using a non-constant-time equality operator - JavaScript's strict inequality operator !== - to validate the GitLab webhook secret token. This operator short-circuits on the first mismatched character, causing earlier-failing comparisons to return faster than later-failing ones, leaking byte-by-byte positional information about the correct token. Coolify is an open-source self-hostable PaaS management tool (CPE: cpe:2.3:a:coollabsio:coolify:*:*:*:*:*:*:*:*) that manages servers, applications, and databases. The affected component is specifically the GitLab webhook ingestion endpoint, which is expected to be publicly reachable to accept push events from GitLab. The correct fix is a constant-time comparison function (e.g., crypto.timingSafeEqual in Node.js or equivalent), which ensures comparison duration does not vary with token content.
RemediationAI
The primary fix is to upgrade Coolify to version 4.0.0-beta.461 or later, which replaces the non-constant-time !== comparison with a timing-safe alternative. Full details are in the GitHub Security Advisory at https://github.com/coollabsio/coolify/security/advisories/GHSA-x525-46rq-mr8c. If an immediate upgrade is not possible, rotate any existing GitLab webhook secret tokens as a compensating control to invalidate any partial token knowledge an attacker may have accumulated. Additionally, restricting webhook endpoint access at the network or reverse-proxy level to GitLab's published IP ranges will reduce the attack surface by limiting who can submit timing probe requests; however, this introduces operational overhead if GitLab IP ranges change and should be treated as a temporary measure rather than a permanent substitute for patching.
Coolify, a self-hosted server management platform, allows authenticated users to inject OS commands through the Git Repo
A command injection vulnerability in Coolify's Database Backup functionality allows authenticated users with application
Coolify through v4.0.0-beta.434 exposes the root user's SSH private key to low-privileged team members. Any user with ba
Cross-team authorization bypass in Coolify (open-source self-hosted PaaS) before 4.0.0-beta.474 allows an authenticated,
Coolify before 4.0.0-beta.445 allows command injection through docker-compose.yaml parameters. If a victim creates an ap
Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deplo
Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application d
Authenticated OS command injection in Coolify before 4.0.0-beta.471 lets any user holding destination management permiss
Authenticated remote code execution in Coolify (self-hosted PaaS) before 4.0.0-beta.470 lets a low-privileged authentica
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. [CVSS 8.8 HIGH]
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0
An authenticated command injection vulnerability in Coolify's PostgreSQL initialization script handling allows attackers
Same weakness CWE-208 – Observable Timing Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today