What is the CVSS score of CVE-2026-41896?

CVE-2026-41896 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Coolify are affected by CVE-2026-41896?

Coolify deployments before version 4.0.0-beta.474 are vulnerable to unauthenticated webhook signature forgery, allowing remote attackers to trigger arbitrary application deployments without…. A patch is available.

How to fix or mitigate CVE-2026-41896?

24 hours: Identify all Coolify instances in production and audit which applications have null manual_webhook_secret_github fields; restrict webhook endpoint network access via firewall to known Git provider IP ranges only. 7 days: Manually configure strong, non-null webhook secrets for every application and enable IP-based webhook source validation; review and log all recent deployment activity for anomalies. 30 days: Prepare to upgrade to Coolify 4.0.0-beta.474 or later when released; if upgrade timeline extends beyond 30 days, evaluate replacement deployment platforms.

Coolify CVE-2026-41896

EUVD-2026-40223 HIGH

Improper Authentication (CWE-287)

2026-06-29 GitHub_M

Authentication Bypass Coolify Coollabsio

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Remote, no auth or interaction, and trivially low complexity since the empty-key HMAC is deterministic; impact is high integrity (forged deployments) with no confidentiality or direct availability loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 29, 2026 - 22:02 EUVD

Analysis Generated

Jun 29, 2026 - 21:15 vuln.today

CVE Published

Jun 29, 2026 - 20:16 cve.org

HIGH 7.5

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the HMAC key is the application's manual_webhook_secret_github field, which is used by Coolify's webhook endpoints to validate incoming requests, is nullable with no default - meaning newly created applications have a null webhook secret. PHP's hash_hmac() function silently coerces a null key to an empty string ''. So when the secret is null, the server computes hash_hmac('sha256', $payload, '') - a deterministic value that any attacker can calculate independently. By sending X-Hub-Signature-256: sha256=<hash_hmac('sha256', payload, '')>, an unauthenticated attacker can forge a valid signature and trigger deployments. This vulnerability is fixed in 4.0.0-beta.474.

AnalysisAI

Webhook signature forgery in Coolify (self-hosted PaaS) before 4.0.0-beta.474 lets unauthenticated remote attackers trigger arbitrary application deployments. Because the per-application manual_webhook_secret_github field is nullable with no default, newly created applications carry a null HMAC key; PHP's hash_hmac() silently coerces null to an empty string, so the expected X-Hub-Signature-256 becomes a deterministic value any attacker can compute offline. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but exploitation is trivial against affected default configurations.

Technical ContextAI

The vulnerability lies in Coolify's GitHub webhook validation path, which authenticates incoming requests by computing an HMAC-SHA256 over the request payload keyed on each application's manual_webhook_secret_github value and comparing it to the attacker-supplied X-Hub-Signature-256 header. CWE-287 (Improper Authentication) is the root cause: the secret column is nullable with no generated default, so freshly created applications hold a null key. PHP's hash_hmac('sha256', $payload, $key) does not reject a null key - it coerces null to the empty string '', producing hash_hmac('sha256', $payload, '') which depends only on the payload an attacker controls. The result is that the secret-keyed integrity check degrades to a publicly reproducible function, fully bypassing the intended authentication. The affected component per CPE is cpe:2.3:a:coollabsio:coolify (all versions prior to the fix).

RemediationAI

Vendor-released patch: upgrade Coolify to 4.0.0-beta.474 or later, which fixes the null-secret HMAC coercion (per advisory GHSA-w8wm-r924-f65v, https://github.com/coollabsio/coolify/security/advisories/GHSA-w8wm-r924-f65v). If immediate upgrade is not possible, the most direct compensating control is to set a strong, non-null manual_webhook_secret_github value on every existing application so hash_hmac is keyed on real entropy rather than an empty string - note this requires updating the corresponding secret in the GitHub webhook configuration or deployments will start failing signature checks. Additionally, restrict network exposure of the webhook endpoints by placing Coolify behind a reverse proxy or firewall that allow-lists GitHub's published webhook source IP ranges, accepting that this breaks self-hosted Git providers or custom webhook senders outside those ranges. Avoid leaving newly created applications with default (null) webhook secrets until the upgrade is applied.