Skip to main content

Coolify CVE-2026-34171

| EUVDEUVD-2026-41988 HIGH
Cross-Site Request Forgery (CSRF) (CWE-352)
2026-07-07 GitHub_M
CSRF Coolify Coollabsio
8.0
CVSS 3.1 · Vendor: GitHub_M
View

Vulnerability Assessment

Weakness
CWE
CWE-352
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK

1 technique across 1 tactic: Initial Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 27, 2026

Account takeover vulnerability in Coolify prior to version 4.0.0-beta.471 allows an attacker to reset a victim’s password to a known value by tricking the victim into visiting a crafted invitation URL. The GET /invitations/{uuid} endpoint could perform a state‑changing password reset when the reset-password query parameter was present, using the invitation UUID (which the attacker knows) as the new password. This is a CSRF‑based attack (CWE‑352) with a CVSS base score of 8.0; the flaw is patched in the official release and is not known to be actively exploited.

Affected VersionsENISA

coolify < 4.0.0-beta.471

Affected Packages

euvd coolify fix: 4.0.0-beta.471

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Coolify gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 8.0 HIGH
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
vuln.today AI 6.8 MEDIUM

Network CSRF (AV:N) needing a known UUID and a victim click gives AC:H/UI:R with PR:N; predictable-password reset yields account takeover (C:H/I:H), but impact stays within the same app so S:U.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

2
Patch available
Jul 07, 2026 - 05:01 EUVD
CVE Published
Jul 07, 2026 - 03:07 cve.org
HIGH 8.0

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GET /invitations/{uuid} endpoint can perform a state-changing password reset using an attacker-known invitation UUID, allowing an attacker who can cause a victim to visit the crafted invitation URL to reset the victim account password to a predictable value. This issue is fixed in version 4.0.0-beta.471.

Threat Intelligence Overview

EPSS Score
0.1%
Top 96% exploitable
Social Media
1
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment CIRCL GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact· derived
Medium
Technical Impact
Total

Priority Score

40
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +40
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Cross-Site Request Forgery MEDIUM

Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.

Related Vulnerabilities in Coolify Command Injection and CSRF Vulnerabilities

View all 5
CVE-2026-34152 HIGH
8.8
CVE-2026-42200 HIGH
8.8
CVE-2026-34168 HIGH
8.8
CVE-2026-42143 HIGH
8.8

More in Coolify

View all
CVE-2026-57498 CRITICAL POC
9.6 Jun 29

Cross-team authorization bypass in Coolify (open-source self-hosted PaaS) before 4.0.0-beta.474 allows an authenticated,
CVE-2025-34161 CRITICAL POC
9.4 Aug 27

Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deplo
CVE-2025-34159 CRITICAL POC
9.4 Aug 27

Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application d
CVE-2025-64424 CRITICAL POC
9.4 Jan 05

Command injection in Coolify up to and including v4.0.0-beta.434 lets any authenticated low-privileged 'member' execute

CVE-2025-59156 CRITICAL POC
9.4 Jan 05

Remote code execution on the host OS is possible through Coolify's application deployment workflow prior to version 4.0.
CVE-2025-66211 CRITICAL POC
9.4 Dec 23

Authenticated command injection in Coolify's PostgreSQL initialization-script filename handling allows users with applic
CVE-2025-66210 CRITICAL POC
9.4 Dec 23

Coolify versions prior to 4.0.0-beta.451 pass user-supplied database names unsanitized into shell commands executed via

CVE-2025-66213 CRITICAL POC
9.4 Dec 23

Authenticated Coolify users who hold application or service management permissions can execute arbitrary commands as roo
CVE-2025-66212 CRITICAL POC
9.4 Dec 23

Authenticated command injection in Coolify before 4.0.0-beta.451 lets users with application or service management permi
CVE-2025-59158 CRITICAL POC
9.4 Jan 05

Stored cross-site scripting in Coolify versions up to and including v4.0.0-beta.420.6 lets an authenticated low-privileg
CVE-2026-34594 HIGH POC
8.8 Jun 29

Authenticated OS command injection in Coolify before 4.0.0-beta.471 lets any user holding destination management permiss
CVE-2026-34597 HIGH POC
8.8 Jun 29

Authenticated remote code execution in Coolify (self-hosted PaaS) before 4.0.0-beta.470 lets a low-privileged authentica

Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2013-5696 MEDIUM POC
6.8
CVE-2020-36836 HIGH POC
8.0
CVE-2015-2295 MEDIUM POC
6.8
CVE-2016-6897 MEDIUM POC
6.5
CVE-2022-41622 HIGH POC
8.8
CVE-2025-2907 CRITICAL POC
9.8

Same technique CSRF

View all
CVE-2017-9757 HIGH POC
8.8
CVE-2013-4152 MEDIUM POC
6.8
CVE-2024-7094 CRITICAL
9.8
CVE-2015-4624 HIGH POC
7.5

References

Advisories & patches
REF https://github.com/coollabsio/coolify/commit/25d424c743d5134d4a005a6d8f754bb3235b632c REF https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471 REF https://github.com/coollabsio/coolify/security/advisories/GHSA-389w-cc6x-wr2m

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy