EUVD-2026-41984Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
AV:N and PR:N confirmed; UI:R reflects required victim click; C:H added because successful account takeover exposes all managed infrastructure credentials, not just integrity.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the TrustProxies middleware trusts all proxies ($proxies = '*'), accepting X-Forwarded-Host from any source. The TrustHosts middleware, intended to prevent host header attacks, has a circular caching dependency that prevents it from ever validating hosts. When a password reset is requested, the ResetPassword notification generates the reset URL using url(route(..., false)), which derives the host from the (spoofable) request. An unauthenticated attacker can trigger a password reset email containing a link pointing to an attacker-controlled domain, enabling token theft and account takeover. This issue is fixed in version 4.0.0-beta.471.
AnalysisAI
Password reset poisoning in Coolify prior to 4.0.0-beta.471 enables unauthenticated account takeover by injecting a forged X-Forwarded-Host header during a password reset request. Two compounding middleware failures make this possible: TrustProxies trusts all proxy sources unconditionally, and TrustHosts is rendered inoperable by a circular caching dependency, meaning the Host header is never validated. The reset URL is generated from the spoofed request host, so the victim's reset token is delivered to an attacker-controlled domain. No public exploit is identified at time of analysis, but the attack is low-friction and the fix is confirmed in version 4.0.0-beta.471.
Technical ContextAI
Coolify is a Laravel-based self-hosted PaaS platform (CPE: cpe:2.3:a:coollabsio:coolify:*:*:*:*:*:*:*:*) for managing servers, applications, and databases. The vulnerability is rooted in CWE-640 (Weak Password Recovery Mechanism for Forgotten Password), specifically a host header injection variant. Laravel's TrustProxies middleware, when configured with proxies = '*', blindly forwards X-Forwarded-Host as the canonical request host. The TrustHosts middleware - the defensive layer designed to allowlist valid hostnames - is bypassed entirely due to a circular caching dependency in its boot cycle, meaning host validation never executes. The ResetPassword notification calls url(route(..., false)) to construct the reset URL, which resolves the host from the active request object - which has already been poisoned by the injected header. This is a classic Laravel/Symfony password reset poisoning pattern, well-documented as an attack class but here enabled by dual middleware failures rather than a single misconfiguration.
RemediationAI
The confirmed fix is to upgrade to Coolify version 4.0.0-beta.471 or later, available at https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471. The upstream fix (PR #9193, commit 98569e4) addresses both the TrustProxies wildcard trust and the TrustHosts caching dependency. If immediate upgrade is not possible, a compensating control is to place Coolify behind a reverse proxy (e.g., nginx, Caddy) that strips or overwrites the X-Forwarded-Host header to a fixed, trusted value before requests reach the application - this prevents injection of attacker-controlled hostnames. Additionally, restricting password reset functionality to internal networks or VPN-only access removes the unauthenticated network vector entirely, though this trades operational convenience for security. Neither workaround fixes the underlying TrustHosts bypass; they only limit the attack surface. Refer to the security advisory at https://github.com/coollabsio/coolify/security/advisories/GHSA-cgj8-7m5q-x5gv for authoritative guidance.
Coolify, a self-hosted server management platform, allows authenticated users to inject OS commands through the Git Repo
A command injection vulnerability in Coolify's Database Backup functionality allows authenticated users with application
Coolify through v4.0.0-beta.434 exposes the root user's SSH private key to low-privileged team members. Any user with ba
Cross-team authorization bypass in Coolify (open-source self-hosted PaaS) before 4.0.0-beta.474 allows an authenticated,
Coolify before 4.0.0-beta.445 allows command injection through docker-compose.yaml parameters. If a victim creates an ap
Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deplo
Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application d
Authenticated OS command injection in Coolify before 4.0.0-beta.471 lets any user holding destination management permiss
Authenticated remote code execution in Coolify (self-hosted PaaS) before 4.0.0-beta.470 lets a low-privileged authentica
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. [CVSS 8.8 HIGH]
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0
An authenticated command injection vulnerability in Coolify's PostgreSQL initialization script handling allows attackers
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today