What is the CVSS score of CVE-2026-42147?

CVE-2026-42147 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-42147?

Yes, a patch is available for CVE-2026-42147. Update the affected software to the latest version immediately.

Coolify CVE-2026-42147

EUVD-2026-41992 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-07 GitHub_M

SSRF Coolify Coollabsio

4.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.9 MEDIUM

PR:H confirmed by storage management permission requirement; C:H reflects credential exposure risk via metadata SSRF; no integrity or availability impact identified.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 07, 2026 - 05:01 EUVD

Analysis Generated

Jul 07, 2026 - 04:12 vuln.today

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, S3 storage endpoint validation only checks URL format and testConnection() sends a server-side request to the configured endpoint, allowing an authenticated user with storage management permissions to make Coolify request internal or metadata-service URLs. This issue is fixed in version 4.0.0-beta.474.

AnalysisAI

Server-Side Request Forgery (SSRF) in Coolify prior to v4.0.0-beta.474 enables an authenticated user holding storage management permissions to coerce the application server into issuing HTTP requests to arbitrary internal addresses, including cloud instance metadata services. The vulnerable code path is Coolify's S3 storage endpoint testConnection() function, which blindly fetches the caller-supplied URL after only superficial format validation. No public exploit or CISA KEV listing exists at time of analysis, but cloud-hosted deployments face elevated risk because successful exploitation can expose cloud provider credentials via metadata endpoints such as AWS IMDSv1.

Technical ContextAI

Coolify (CPE: cpe:2.3:a:coollabsio:coolify:*:*:*:*:*:*:*:*) is a self-hostable server and application management platform. The affected feature allows users to configure S3-compatible storage backends by supplying an endpoint URL. The validation routine checks only URL syntax and does not enforce allowlists, block RFC-1918 private ranges, loopback addresses (127.0.0.0/8), or link-local ranges (169.254.0.0/16). The testConnection() function then performs a live server-side HTTP request to the supplied URL. This is a classic CWE-918 (Server-Side Request Forgery) pattern - user-controlled input is used to initiate a network request from the server without adequate destination validation, turning the application server into an unintended HTTP proxy for internal network reconnaissance or metadata service access.

RemediationAI

Upgrade Coolify to version 4.0.0-beta.474 or later; the fix is confirmed by commit 297e9c41e19958f6237919794c28c3fb1d4cda32 and the corresponding release at https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.474. If an immediate upgrade is not feasible, apply the following compensating controls: restrict storage management permissions to the minimum necessary set of trusted administrator accounts (reduces the privilege surface but does not eliminate the flaw for those who retain access); implement host-level or network-level egress filtering on the Coolify application server to block outbound requests to RFC-1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local ranges including cloud metadata services (169.254.0.0/16). Note that egress filtering can break legitimate internal S3-compatible storage configurations if those endpoints reside on private addresses, so coordinate with network teams before applying broad blocks.