Coolify EUVD-2026-41981

The attacker must hold a valid authenticated Coolify account (CVSS PR:L) and be able to reach the terminal WebSocket bootstrap routes over the network. The exact prerequisite is that the request targets terminal functionality for a resource outside the attacker's authorized scope - the vulnerable routes fail to invoke the expected authorization middleware, so no additional feature toggle or non-default setting is needed. Exploitation is limited chiefly by the requirement for an existing account: an instance with only a single trusted administrator and no other users has little practical exposure, whereas multi-user or multi-tenant deployments where untrusted parties can register or be invited are directly at risk. Applies to all versions before 4.0.0-beta.471.

The signals are largely aligned toward high priority but with important nuance. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with a scope change reflecting that a compromised authorization boundary lets the attacker affect resources beyond the initially authorized security context - consistent with terminal command execution on out-of-scope hosts. The critical limiting factor is PR:L: the attacker must already hold a valid authenticated Coolify account, so this is not an unauthenticated internet-wide bug. No EPSS score was provided, so exploitation probability cannot be quantified here. There is no CISA KEV entry and no public POC identified - only the vendor advisory, fix PR, and commit - so this is not confirmed to be actively exploited. The realistic risk is highest for multi-user or multi-tenant Coolify deployments where untrusted or lower-trust users have accounts; in a single-admin self-hosted instance the practical impact is much lower. Overall a genuine high-priority patch item for shared instances, less urgent for single-operator setups.

A low-privileged but authenticated user on a shared Coolify instance - for example a developer scoped to a single project - sends a crafted terminal WebSocket bootstrap request naming a server or container belonging to another team. Because the authorization middleware is not enforced on that route, the session is established against the out-of-scope resource, and the attacker gains an interactive terminal to execute commands on hosts they were never granted access to. No public POC is currently identified, but the low attack complexity and lack of required user interaction make exploitation straightforward for anyone with an account.