Coolify EUVD-2026-40328

Exploitation requires that the target Coolify instance has at least one GitLab webhook integration configured with a secret token, and that the GitLab webhook endpoint is reachable by the attacker over the network. The attacker must be able to send a large volume of HTTP requests (potentially thousands to tens of thousands) and achieve timing resolution sufficient to distinguish per-character response time differences, which requires low network jitter - making remote exploitation from the public internet significantly harder than from a co-located or low-latency position. Exploitation is not applicable to Coolify instances without any GitLab integrations or those with the webhook endpoint blocked at the network perimeter. Authentication is not required per CVSS PR:N.

The CVSS 3.1 score of 4.8 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N is consistent with the nature of this vulnerability. AC:H is the critical moderating factor: timing attacks against a network endpoint are heavily affected by jitter, latency variance, and request volume requirements, making reliable exploitation from the open internet difficult without controlled network conditions. No EPSS score was provided in the input data, so exploitation probability cannot be quantified from that signal. KEV status is negative and no POC is known, confirming this is not a currently exploited vulnerability. The confidentiality and integrity impacts are bounded - C:L reflects disclosure of the webhook secret, and I:L reflects the ability to spoof webhook events. The real-world priority is low-to-medium: deployments with publicly exposed webhook endpoints and GitLab integrations should patch promptly, but this is not an emergency for air-gapped or non-GitLab-integrated Coolify instances. No data conflicts exist between available signals.

An attacker with reliable, low-latency access to the Coolify instance's GitLab webhook endpoint submits thousands of HTTP POST requests with incrementally varied secret token values, carefully measuring response times to identify which byte positions match the real token character by character. After accumulating sufficient statistical samples to overcome network jitter, the attacker reconstructs the full webhook secret and uses it to craft a forged GitLab push-event payload, causing Coolify to execute an unauthorized deployment or pipeline action.