Coolify CVE-2026-42145

Exploitation requires a valid authenticated session in Coolify, specifically an account with access to the database backup restore feature (CVSS PR:L). The attacker must be able to reach the Coolify web interface over the network (AV:N). No special configuration is needed beyond having a user account - the vulnerable endpoint is part of standard Coolify functionality. Exploitation is limited to availability impact only; confidentiality and integrity are unaffected (C:N/I:N per CVSS), ruling out data exfiltration or code execution via this path. The CVSS AC:H rating indicates the vendor considers successful availability impact to be subject to deployment-specific conditions such as available disk capacity. Externally unauthenticated users cannot exploit this vulnerability.

The CVSS 3.1 base score of 3.1 with vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L reflects limited real-world severity: exploitation requires authenticated access (PR:L), yields only low availability impact (A:L), and the vendor assessed high attack complexity (AC:H). There is no CISA KEV listing and no public proof-of-concept exploit, reinforcing that this is not under active exploitation. No EPSS score was provided in the source data, so exploitation probability cannot be quantified numerically. The confidentiality and integrity impact are both None, meaning this cannot be used for data theft or system compromise - only service disruption. The NVD-assigned AC:H is notable and likely reflects that successful exploitation to materially affect availability may depend on storage constraints of the specific deployment. This is a real but low-priority finding: the authenticated barrier and narrow impact make it a hardening item rather than an emergency patch.

An authenticated Coolify user - such as a low-privileged team member with restore access - submits a multi-gigabyte file to the backup restore upload endpoint without restriction. The server accepts and stores the payload, exhausting available disk space on the host and disrupting Coolify's ability to manage databases and applications for other users. No public proof-of-concept exists for this vulnerability.