Coolify EUVD-2026-41997

Exploitation requires an authenticated Coolify user account - the CVSS PR:L metric confirms low-privilege authentication is sufficient; unauthenticated exploitation is not possible. The attacker must have access to the GitHub App source configuration interface within Coolify (i.e., the GitHub App integration feature must be accessible to their account). No special server-side configuration beyond a default Coolify installation is required - the api_url field is present by default in the GitHub App setup flow. Exploitation impact is bounded by what services are reachable from the Coolify server's network: deployments on cloud VMs with metadata endpoints face elevated risk, while air-gapped or bare-metal deployments with no sensitive internal endpoints face reduced practical impact.

The NVD CVSS 3.1 score of 4.3 (Medium) reflects AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - network-reachable, low complexity, requiring low privileges, with limited confidentiality impact and no integrity or availability impact. This score correctly captures the authentication barrier (PR:L) and scope boundary (S:U). No EPSS data was provided in the input, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, and no POC has been identified. Despite the moderate CVSS, real-world risk is meaningfully elevated for cloud deployments: SSRF against 169.254.169.254 (AWS IMDS, GCP metadata, Azure IMDS) can yield IAM credentials or instance metadata that enable privilege escalation far beyond the C:L rating suggests. On bare-metal or purely on-premises deployments with no sensitive metadata endpoints, practical risk is closer to the CVSS rating. The SSRF-only impact (no write path, no scope change) keeps this below critical, but cloud deployment context is the decisive factor.

An authenticated Coolify user with access to the GitHub App configuration UI sets the api_url field to http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS IMDS endpoint). When Coolify processes this GitHub App source, it issues a server-side HTTP GET to that URL and returns the response, leaking the IAM role name attached to the instance. The attacker then queries the full credential endpoint to obtain temporary AWS access keys, potentially enabling lateral movement into cloud infrastructure. No public POC exists at time of analysis, but this is a standard SSRF-to-cloud-credential attack pattern.