What is the CVSS score of CVE-2026-42172?

CVE-2026-42172 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-42172?

Yes, a patch is available for CVE-2026-42172. Update the affected software to the latest version immediately.

Coolify CVE-2026-42172

EUVD-2026-41980 LOW

Insufficient Session Expiration (CWE-613)

2026-07-07 GitHub_M

Information Disclosure Coolify

3.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

Token leak is a required precondition (AC:H, PR:L); read-only API access limits impact to C:L with no integrity or availability consequence.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 07, 2026 - 05:01 EUVD

Analysis Generated

Jul 07, 2026 - 04:11 vuln.today

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Sanctum API tokens did not expire, allowing a leaked token to retain access indefinitely until manually revoked. This issue is fixed in version 4.0.0-beta.474.

AnalysisAI

Sanctum API tokens in Coolify never expire prior to v4.0.0-beta.474, meaning any token that is leaked or stolen remains permanently valid until an administrator manually revokes it. This affects the self-hosted server, application, and database management platform across all versions below 4.0.0-beta.474. An attacker who obtains a valid API token via secondary means retains indefinite read access to the Coolify API without natural time-bounded expiry as a safeguard. No public exploit has been identified at time of analysis, and the low CVSS score of 3.1 reflects the constrained real-world impact.

Technical ContextAI

Coolify (CPE: cpe:2.3:a:coollabsio:coolify:*) is a PHP/Laravel-based self-hosted management platform that uses Laravel Sanctum for API token authentication. CWE-613 (Insufficient Session Expiration) describes the root cause: Sanctum tokens were issued without an expiration timestamp, violating the security principle that credentials should have bounded lifetimes. This is a design-level omission in token lifecycle management rather than a memory corruption or injection flaw. The fix was introduced via pull request #9677 (commit b1a78df58efe3ac38679d18c888b5817c7f01216) and shipped in release v4.0.0-beta.474, indicating the remediation involved adding token expiry enforcement to the Sanctum configuration.

RemediationAI

The primary fix is to upgrade Coolify to v4.0.0-beta.474 or later, available at https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.474. After upgrading, administrators should audit and revoke all existing Sanctum API tokens as a precautionary measure, since previously issued tokens under the old behavior had no expiry and may already be circulating. As a compensating control before patching, administrators can manually revoke tokens via the Coolify UI for any users or service accounts whose tokens may have been exposed; note that this is a reactive measure and does not prevent future indefinite-lifetime issuance without the patch. Restricting API access to trusted network segments or VPN can limit the blast radius of any leaked token but does not address the root cause.