Coolify EUVD-2026-41992

Exploitation requires an authenticated Coolify session with the storage management permission role (CVSS PR:H confirmed by vector). The specific trigger is the testConnection() function within the S3 storage endpoint configuration workflow - this function must be reachable via the authenticated session. Cloud-hosted Coolify instances are significantly more exposed because IMDSv1 endpoints (169.254.169.254) are accessible by default from the host without additional configuration and do not require authentication. On-premises deployments are limited to internal network service exposure, which depends on what services are reachable from the Coolify host. Exploitation is not possible without holding the storage management permission, and is not possible against cloud environments where IMDSv2 is enforced with hop-limit restrictions (IMDSv2 hop-limit of 1 blocks application-level SSRF from reaching the metadata service in most configurations).

The CVSS 3.1 score of 4.9 (Medium) is driven heavily by PR:H, which accurately reflects that exploitation requires an authenticated account with storage management permissions - a meaningful prerequisite that substantially narrows the attack surface compared to unauthenticated SSRF. Despite the medium score, the C:H metric is significant: in cloud environments, SSRF against IMDSv1 endpoints (169.254.169.254) can yield instance identity credentials and IAM role tokens without any additional steps. No EPSS data was provided in the input and no KEV listing exists, placing this in the category of no public exploit identified at time of analysis. The real-world risk is deployment-context-dependent: on-premises Coolify instances face lower risk (internal service exposure), while cloud-hosted deployments are materially more exposed due to metadata service reachability. The CVSS scope is marked Unchanged (S:U), which is defensible if only the Coolify host's accessible network is considered, though lateral exposure via metadata credentials effectively crosses a scope boundary in practice.

An attacker with a Coolify account that has storage management rights navigates to the S3 storage configuration interface and enters http://169.254.169.254/latest/meta-data/iam/security-credentials/ as the endpoint URL. Upon clicking the test connection button, Coolify's backend executes testConnection(), fetching the metadata URL from the cloud instance hosting Coolify, and the response - containing temporary IAM role credentials - is surfaced back to the attacker through the application interface or error output. No public proof-of-concept code has been identified, but this is a standard and well-understood SSRF exploitation pattern.