EUVD-2026-41997Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Low-privilege authentication required to configure GitHub App; SSRF yields read-only access to internal endpoints with no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp api_url field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowing an authenticated user to configure a GitHub App source that causes Coolify to request internal services or cloud metadata endpoints. This issue is reported as fixed in version 4.0.0-beta.471.
AnalysisAI
Server-Side Request Forgery (SSRF) in Coolify's GitHub App integration exposes internal network services and cloud metadata endpoints to authenticated low-privilege users. Versions prior to 4.0.0-beta.471 allow any authenticated user to set the GithubApp api_url field to an arbitrary URL - including RFC 1918 private addresses or cloud instance metadata endpoints like 169.254.169.254 - which Coolify then fetches server-side without restriction. No public exploit identified at time of analysis, but the attack pattern is well understood and particularly dangerous in cloud-hosted deployments where metadata endpoints may expose IAM credentials.
Technical ContextAI
The root cause is CWE-918 (Server-Side Request Forgery): user-controlled input is used as the base URL for outbound server-side HTTP requests without allowlisting or private-IP blocklisting. Coolify, identified via CPE cpe:2.3:a:coollabsio:coolify:*:*:*:*:*:*:*:*, is a self-hosted infrastructure management platform that orchestrates servers, applications, and databases - meaning it typically runs with broad network access to internal services. The vulnerable code path accepts the GithubApp api_url field and passes it directly into server-side HTTP requests, bypassing no validation against RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud hypervisor metadata endpoints. Because Coolify is often deployed on cloud VMs with attached IAM roles, this SSRF class is a known path to credential theft via the instance metadata service.
RemediationAI
Upgrade Coolify to version 4.0.0-beta.471 or later; this is the vendor-confirmed fix per the advisory at https://github.com/coollabsio/coolify/security/advisories/GHSA-3g6r-cxv5-3c7h. If immediate upgrade is not possible, apply egress network filtering on the Coolify host to block outbound connections to RFC 1918 private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the cloud metadata IP 169.254.169.254 - this directly mitigates the highest-risk SSRF targets but does not eliminate SSRF against other internal addresses and adds firewall rule management overhead. Additionally, restrict the Coolify GitHub App configuration feature to administrator-only roles if the platform supports role-based access controls, reducing the pool of users who can trigger the vulnerable code path. Upgrading remains the only complete fix.
Coolify, a self-hosted server management platform, allows authenticated users to inject OS commands through the Git Repo
A command injection vulnerability in Coolify's Database Backup functionality allows authenticated users with application
Coolify through v4.0.0-beta.434 exposes the root user's SSH private key to low-privileged team members. Any user with ba
Cross-team authorization bypass in Coolify (open-source self-hosted PaaS) before 4.0.0-beta.474 allows an authenticated,
Coolify before 4.0.0-beta.445 allows command injection through docker-compose.yaml parameters. If a victim creates an ap
Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deplo
Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application d
Authenticated OS command injection in Coolify before 4.0.0-beta.471 lets any user holding destination management permiss
Authenticated remote code execution in Coolify (self-hosted PaaS) before 4.0.0-beta.470 lets a low-privileged authentica
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. [CVSS 8.8 HIGH]
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0
An authenticated command injection vulnerability in Coolify's PostgreSQL initialization script handling allows attackers
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today