Coolify CVE-2026-41896

Exploitation requires the target application's manual_webhook_secret_github value to be null/empty - the default state for applications created in Coolify prior to 4.0.0-beta.474 that were never assigned a manual webhook secret - and the Coolify webhook endpoint must be network-reachable by the attacker. Given that precondition, no authentication, credentials, user interaction, or secret knowledge is needed (CVSS PR:N/UI:N): the attacker simply computes hash_hmac('sha256', payload, '') and supplies it in X-Hub-Signature-256. What LIMITS exploitation: applications that already have a non-null webhook secret configured are not exploitable via this empty-key path, instances not exposed to the attacker's network are out of reach, and the impact is bounded to triggering deployments (integrity) rather than direct code execution or data disclosure.

The provided CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (base 7.5) is internally consistent with the description: network-reachable, low complexity, no privileges, no user interaction, with a high integrity impact (forged deployments) and no direct confidentiality or availability loss. This is a genuine, easy-to-exploit authentication bypass rather than a high-CVSS-but-low-real-risk issue, because the forged signature is deterministic and requires no secret knowledge or brute force. EPSS score, KEV status, POC availability, and SSVC decision data were NOT provided in the input, so exploitation probability and automatability cannot be quantified from this data set - the assessment that it is 'trivially exploitable' is inferred from the description's mechanics, not from an EPSS/KEV signal. Real-world priority is moderate-to-high for any organization running an exposed Coolify instance with default-created applications; the main limiting factor is the constrained impact (deployment triggering, not direct RCE or data theft) and the medium deployment footprint of the product.

An attacker enumerates an internet-exposed Coolify instance and identifies the GitHub webhook endpoint for an application created with no webhook secret. The attacker crafts a deployment-triggering JSON payload, computes sha256=hash_hmac('sha256', payload, '') locally, and sends it with a matching X-Hub-Signature-256 header, causing Coolify to accept the forged request and trigger a deployment. No public exploit code was identified in the provided data, but the calculation requires only standard HMAC tooling.