Coolify CVE-2026-42172

Exploitation requires the attacker to first obtain a valid Coolify Sanctum API token through a separate vector - the CVSS PR:L metric confirms a low-privilege authenticated credential is necessary; unauthenticated exploitation is not possible. The AC:H metric reflects the prerequisite that a token must be leaked or stolen before this vulnerability becomes relevant. The vulnerability does not enable initial compromise on its own; it only extends the window of access after a token has already been obtained. Exploitation is further limited to instances where the Coolify API is network-accessible (AV:N), but self-hosted deployments commonly expose the API to internal networks or the internet. There is no requirement for user interaction (UI:N), meaning once a token is obtained, the attacker can operate autonomously. The scope is unchanged (S:U), so exploitation cannot pivot to other systems beyond the Coolify instance itself.

The CVSS 3.1 score of 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects the constrained nature of this vulnerability. AC:H is appropriate because exploitation requires a precondition: the attacker must first obtain a valid API token through a separate compromise vector such as log exposure, insecure backup storage, or developer workstation compromise. PR:L confirms an authenticated token is required. The impact is limited to confidentiality (C:L) with no integrity or availability consequence, consistent with the Information Disclosure tag. No EPSS data was provided in the input, and this CVE has no CISA KEV listing and no known public exploit code - the real-world risk is therefore low to moderate, primarily relevant for environments where token leakage is plausible (e.g., shared secrets in CI pipelines or publicly accessible logs). The principal danger is not acute exploitation but silent, prolonged unauthorized access after a token leak that goes undetected because the token never expires.

An attacker who intercepts a Coolify API token - for example, from an exposed environment variable in a public repository, an unprotected log file, or a compromised CI/CD pipeline - can use that token indefinitely to query the Coolify API and retrieve sensitive configuration data about managed servers, applications, and databases. Because the token never expires, the attacker retains access silently even after the original credential leak is forgotten or the legitimate user rotates their password. No public proof-of-concept code has been identified at time of analysis.