Coollabs
Monthly
Account takeover in Coolify v4.0.0-beta.434 and earlier is possible because the self-hosted platform's password-reset flow builds the reset link from the attacker-controllable HTTP Host header, so a remote unauthenticated attacker can trigger a reset for a known victim email and have the resulting email point at a server they control - capturing the reset token when the victim clicks the link and using it to set a new password. No authentication is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), but exploitation is per-victim and strictly dependent on the target clicking the poisoned link; instances that pin a canonical application URL or enforce a trusted Host header at a reverse proxy are not exploitable. Publicly available exploit code exists, but there is no confirmed active exploitation in the wild (EPSS is only 0.05%, ~15th percentile) and no vendor-released patch is confirmed as of publication.
Command injection in Coolify up to and including v4.0.0-beta.434 lets any authenticated low-privileged 'member' execute arbitrary system commands as root on the Coolify instance by supplying shell metacharacters in a resource's git source input field. Remote exploitation requires no admin rights and no user interaction, so any team-shared or multi-tenant deployment that lets members create or edit resources is exposed, and this is a genuine high-priority issue rather than a CVSS-inflated one. Publicly available exploit code exists (NVD exploit references including a GitHub security advisory and an accompanying demonstration file), while the EPSS score remains low at 0.47% (64th percentile) and no fixed version was confirmed at the time of publication.
Privilege escalation in Coolify (self-hostable server/application/database management platform) up to and including v4.0.0-beta.434 allows a low-privileged 'member' account to view and redeem administrator invitation links, letting the attacker log in with administrator privileges before the legitimate recipient accepts the invite. Exploitation is not unauthenticated - the CVSS 4.0 vector (PR:L) and our independent CVSS 3.1 assessment (AV:N/AC:H/PR:L/UI:N) confirm the attacker must already hold a valid member account on a shared, multi-user instance, and must win a timing window (AT:P) in which an admin invitation is outstanding and still unclaimed. Publicly available exploit code exists, though there is no confirmed active exploitation (not in CISA KEV) and EPSS is low at 0.05% (16th percentile); real-world risk is therefore moderate and bounded by the member foothold and race-condition prerequisites.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify vstarting with version 4.0.0-beta.434, the /login endpoint advertises a rate limit of 5 requests but can be trivially bypassed by rotating the X-Forwarded-For header. [CVSS 4.3 MEDIUM]
Privilege escalation in Coolify (coollabs) up to and including v4.0.0-beta.434 lets an authenticated low-privileged member gain full administrator control by abusing the team invitation workflow: the first attempt to invite an administrator-level user returns an error, but re-submitting the same invite succeeds and creates the higher-privileged account. The attacker can then initiate a password reset against that newly created admin identity and log in as an administrator, achieving complete compromise of the instance (high confidentiality, integrity, and availability impact). Exploitation requires a valid low-privileged member account and no victim interaction; publicly available exploit code exists (GitHub advisory GHSA-4p6r-m39m-9cm9), there is no confirmation of active exploitation, and EPSS is low at roughly 0.04% (13th percentile).
Coolify instances running v4.0.0-beta.434 or earlier expose the root user's private SSH key to any authenticated low-privilege user, turning a limited application account into full root access on the underlying host (C:H/I:H/A:H, CVSS 8.8). The vulnerable path requires an existing low-privilege Coolify account (PR:L per the vector) and then yields the root SSH key with no further interaction, though escalating to root also requires network reachability of the host's SSH service. Publicly available exploit code exists and the EPSS score is low (0.05%, 16th percentile), and as of publication it is unclear whether a vendor patch is available, so multi-user or multi-tenant Coolify deployments are the primary risk population while single-operator installations with no additional low-privilege users have effectively no exposed attacker population.
Command injection in Coolify instances running versions prior to 4.0.0-beta.445 lets an attacker who controls the Git repository used to create an application execute arbitrary commands as root on the Coolify host. The flaw is triggered when a victim user creates or deploys an application using the 'docker compose' build pack from an attacker-supplied repository whose docker-compose.yaml supplies unsanitized parameters that are later interpolated into shell commands executed by Coolify. Publicly available exploit code exists, and the CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms a remote, unauthenticated attack path that nevertheless requires the victim to initiate the build, so real-world exploitation is gated by social engineering rather than direct remote access; EPSS is low at roughly 0.09% (26th percentile). A vendor patch is available in version 4.0.0-beta.445.
Coolify versions up to 4.0.0 contains a vulnerability that allows attackers to a malicious actor to perform an unauthorized email address change on behalf of t (CVSS 5.7).
Stored cross-site scripting in Coolify versions up to and including v4.0.0-beta.420.6 lets an authenticated low-privilege member create a project whose name contains JavaScript; the payload runs in an administrator's browser when the admin later opens the delete flow for that project or an associated resource. Publicly available exploit code exists, but EPSS is low (0.05%, 15th percentile) and no CISA KEV active-exploitation signal was provided, so practical priority is moderate despite the vendor's CVSS 4.0 base of 9.4; the independent CVSS 3.1 assessment is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, reflecting the need for a member account and administrator interaction. Exposure mainly affects multi-tenant or team deployments where untrusted members can create projects, while single-admin self-hosted instances without untrusted members are effectively not exposed.
Command injection in Coolify's Git Repository field during project creation allows an authenticated member account to run arbitrary shell commands on the self-hosted Coolify server when the project's deployment workflow executes. All releases prior to 4.0.0-beta.420.7 are affected, and publicly available exploit code exists, so member-restricted instances that permit untrusted or self-registered users carry real risk. Exploitation is access-gated rather than anonymous: the CVSS vector (PR:L, AV:N, UI:N) confirms a low-privileged authenticated attacker is required, and the EPSS score of 0.26% (49th percentile) indicates low observed exploitation activity with no CISA KEV listing at time of analysis.
Remote code execution on the host OS is possible through Coolify's application deployment workflow prior to version 4.0.0-beta.420.7, where an authenticated member-level user can inject malicious Docker Compose directives-such as bind mounts of the host filesystem-during project creation or updates. This bypasses container isolation and yields root-level command execution on the Coolify host. Publicly available exploit code exists, and while the EPSS score is modest at 0.42% (62nd percentile), the severity is high because exploitation requires only a low-privileged team account and no user interaction; a vendor patch is available.
Authenticated Coolify users who hold application or service management permissions can execute arbitrary commands as root on managed servers by supplying a crafted file_storage_directory_source value in the File Storage Directory Mount Path feature. The parameter reaches shell command construction without sanitization, so shell metacharacters enable full host compromise; no victim interaction is required, but the attacker must already be authenticated with management rights. Publicly available exploit code exists, the vendor fixed the flaw in 4.0.0-beta.451, and EPSS is low at 0.20%, suggesting limited observed exploitation at time of analysis.
Authenticated command injection in Coolify before 4.0.0-beta.451 lets users with application or service management permissions execute arbitrary commands as root on managed servers by supplying a Dynamic Proxy Configuration filename containing shell metacharacters. Exploitation requires a valid low-privilege Coolify account and no user interaction; unauthenticated or read-only users cannot trigger it directly. Publicly available exploit code exists, but EPSS is only 0.20% (41st percentile), and risk is concentrated in multi-user or shared deployments where service-management roles are broadly granted or an operator account is compromised.
Authenticated command injection in Coolify's PostgreSQL initialization-script filename handling allows users with application or service management permissions to execute arbitrary commands as root on managed servers. All Coolify 4.0.0 beta builds prior to beta.451 are affected, publicly available exploit code exists, and the upstream fix also covers database names used in backup configuration. EPSS is low at 0.41% (61st percentile), but the impact is severe for multi-user or multi-tenant deployments where lower-trust operators hold management rights.
Coolify versions prior to 4.0.0-beta.451 pass user-supplied database names unsanitized into shell commands executed via docker exec on managed servers, allowing an authenticated user with application/service management permissions to run arbitrary commands as root. Exploitation is remote but requires a valid management-capable account (PR:L), so the realistic exposure is multi-user, multi-tenant, or credential-compromise scenarios rather than anonymous mass exploitation. Publicly available exploit code exists and EPSS is modest at 0.41% (61st percentile); no confirmed active exploitation (CISA KEV) at time of analysis.
Authenticated command injection in Coolify before 4.0.0-beta.451 allows users with application or service management permissions to execute arbitrary commands as root on managed servers through the Database Backup feature. The flaw is caused by database names being inserted into shell commands without sanitization when backup jobs invoke mongodump, pg_dump, mysqldump, and mariadb-dump via docker exec; publicly available exploit code exists and EPSS is 0.20% (42nd percentile). The vendor-released patch is version 4.0.0-beta.451, and no CISA KEV confirmation was provided in the available data.
Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Rated low severity (CVSS 1.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Rated medium severity (CVSS 4.7), this vulnerability is low attack complexity. No vendor patch available.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Rated high severity (CVSS 8.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Rated high severity (CVSS 8.5), this vulnerability is low attack complexity. Public exploit code available.
Account takeover in Coolify v4.0.0-beta.434 and earlier is possible because the self-hosted platform's password-reset flow builds the reset link from the attacker-controllable HTTP Host header, so a remote unauthenticated attacker can trigger a reset for a known victim email and have the resulting email point at a server they control - capturing the reset token when the victim clicks the link and using it to set a new password. No authentication is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), but exploitation is per-victim and strictly dependent on the target clicking the poisoned link; instances that pin a canonical application URL or enforce a trusted Host header at a reverse proxy are not exploitable. Publicly available exploit code exists, but there is no confirmed active exploitation in the wild (EPSS is only 0.05%, ~15th percentile) and no vendor-released patch is confirmed as of publication.
Command injection in Coolify up to and including v4.0.0-beta.434 lets any authenticated low-privileged 'member' execute arbitrary system commands as root on the Coolify instance by supplying shell metacharacters in a resource's git source input field. Remote exploitation requires no admin rights and no user interaction, so any team-shared or multi-tenant deployment that lets members create or edit resources is exposed, and this is a genuine high-priority issue rather than a CVSS-inflated one. Publicly available exploit code exists (NVD exploit references including a GitHub security advisory and an accompanying demonstration file), while the EPSS score remains low at 0.47% (64th percentile) and no fixed version was confirmed at the time of publication.
Privilege escalation in Coolify (self-hostable server/application/database management platform) up to and including v4.0.0-beta.434 allows a low-privileged 'member' account to view and redeem administrator invitation links, letting the attacker log in with administrator privileges before the legitimate recipient accepts the invite. Exploitation is not unauthenticated - the CVSS 4.0 vector (PR:L) and our independent CVSS 3.1 assessment (AV:N/AC:H/PR:L/UI:N) confirm the attacker must already hold a valid member account on a shared, multi-user instance, and must win a timing window (AT:P) in which an admin invitation is outstanding and still unclaimed. Publicly available exploit code exists, though there is no confirmed active exploitation (not in CISA KEV) and EPSS is low at 0.05% (16th percentile); real-world risk is therefore moderate and bounded by the member foothold and race-condition prerequisites.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify vstarting with version 4.0.0-beta.434, the /login endpoint advertises a rate limit of 5 requests but can be trivially bypassed by rotating the X-Forwarded-For header. [CVSS 4.3 MEDIUM]
Privilege escalation in Coolify (coollabs) up to and including v4.0.0-beta.434 lets an authenticated low-privileged member gain full administrator control by abusing the team invitation workflow: the first attempt to invite an administrator-level user returns an error, but re-submitting the same invite succeeds and creates the higher-privileged account. The attacker can then initiate a password reset against that newly created admin identity and log in as an administrator, achieving complete compromise of the instance (high confidentiality, integrity, and availability impact). Exploitation requires a valid low-privileged member account and no victim interaction; publicly available exploit code exists (GitHub advisory GHSA-4p6r-m39m-9cm9), there is no confirmation of active exploitation, and EPSS is low at roughly 0.04% (13th percentile).
Coolify instances running v4.0.0-beta.434 or earlier expose the root user's private SSH key to any authenticated low-privilege user, turning a limited application account into full root access on the underlying host (C:H/I:H/A:H, CVSS 8.8). The vulnerable path requires an existing low-privilege Coolify account (PR:L per the vector) and then yields the root SSH key with no further interaction, though escalating to root also requires network reachability of the host's SSH service. Publicly available exploit code exists and the EPSS score is low (0.05%, 16th percentile), and as of publication it is unclear whether a vendor patch is available, so multi-user or multi-tenant Coolify deployments are the primary risk population while single-operator installations with no additional low-privilege users have effectively no exposed attacker population.
Command injection in Coolify instances running versions prior to 4.0.0-beta.445 lets an attacker who controls the Git repository used to create an application execute arbitrary commands as root on the Coolify host. The flaw is triggered when a victim user creates or deploys an application using the 'docker compose' build pack from an attacker-supplied repository whose docker-compose.yaml supplies unsanitized parameters that are later interpolated into shell commands executed by Coolify. Publicly available exploit code exists, and the CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms a remote, unauthenticated attack path that nevertheless requires the victim to initiate the build, so real-world exploitation is gated by social engineering rather than direct remote access; EPSS is low at roughly 0.09% (26th percentile). A vendor patch is available in version 4.0.0-beta.445.
Coolify versions up to 4.0.0 contains a vulnerability that allows attackers to a malicious actor to perform an unauthorized email address change on behalf of t (CVSS 5.7).
Stored cross-site scripting in Coolify versions up to and including v4.0.0-beta.420.6 lets an authenticated low-privilege member create a project whose name contains JavaScript; the payload runs in an administrator's browser when the admin later opens the delete flow for that project or an associated resource. Publicly available exploit code exists, but EPSS is low (0.05%, 15th percentile) and no CISA KEV active-exploitation signal was provided, so practical priority is moderate despite the vendor's CVSS 4.0 base of 9.4; the independent CVSS 3.1 assessment is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, reflecting the need for a member account and administrator interaction. Exposure mainly affects multi-tenant or team deployments where untrusted members can create projects, while single-admin self-hosted instances without untrusted members are effectively not exposed.
Command injection in Coolify's Git Repository field during project creation allows an authenticated member account to run arbitrary shell commands on the self-hosted Coolify server when the project's deployment workflow executes. All releases prior to 4.0.0-beta.420.7 are affected, and publicly available exploit code exists, so member-restricted instances that permit untrusted or self-registered users carry real risk. Exploitation is access-gated rather than anonymous: the CVSS vector (PR:L, AV:N, UI:N) confirms a low-privileged authenticated attacker is required, and the EPSS score of 0.26% (49th percentile) indicates low observed exploitation activity with no CISA KEV listing at time of analysis.
Remote code execution on the host OS is possible through Coolify's application deployment workflow prior to version 4.0.0-beta.420.7, where an authenticated member-level user can inject malicious Docker Compose directives-such as bind mounts of the host filesystem-during project creation or updates. This bypasses container isolation and yields root-level command execution on the Coolify host. Publicly available exploit code exists, and while the EPSS score is modest at 0.42% (62nd percentile), the severity is high because exploitation requires only a low-privileged team account and no user interaction; a vendor patch is available.
Authenticated Coolify users who hold application or service management permissions can execute arbitrary commands as root on managed servers by supplying a crafted file_storage_directory_source value in the File Storage Directory Mount Path feature. The parameter reaches shell command construction without sanitization, so shell metacharacters enable full host compromise; no victim interaction is required, but the attacker must already be authenticated with management rights. Publicly available exploit code exists, the vendor fixed the flaw in 4.0.0-beta.451, and EPSS is low at 0.20%, suggesting limited observed exploitation at time of analysis.
Authenticated command injection in Coolify before 4.0.0-beta.451 lets users with application or service management permissions execute arbitrary commands as root on managed servers by supplying a Dynamic Proxy Configuration filename containing shell metacharacters. Exploitation requires a valid low-privilege Coolify account and no user interaction; unauthenticated or read-only users cannot trigger it directly. Publicly available exploit code exists, but EPSS is only 0.20% (41st percentile), and risk is concentrated in multi-user or shared deployments where service-management roles are broadly granted or an operator account is compromised.
Authenticated command injection in Coolify's PostgreSQL initialization-script filename handling allows users with application or service management permissions to execute arbitrary commands as root on managed servers. All Coolify 4.0.0 beta builds prior to beta.451 are affected, publicly available exploit code exists, and the upstream fix also covers database names used in backup configuration. EPSS is low at 0.41% (61st percentile), but the impact is severe for multi-user or multi-tenant deployments where lower-trust operators hold management rights.
Coolify versions prior to 4.0.0-beta.451 pass user-supplied database names unsanitized into shell commands executed via docker exec on managed servers, allowing an authenticated user with application/service management permissions to run arbitrary commands as root. Exploitation is remote but requires a valid management-capable account (PR:L), so the realistic exposure is multi-user, multi-tenant, or credential-compromise scenarios rather than anonymous mass exploitation. Publicly available exploit code exists and EPSS is modest at 0.41% (61st percentile); no confirmed active exploitation (CISA KEV) at time of analysis.
Authenticated command injection in Coolify before 4.0.0-beta.451 allows users with application or service management permissions to execute arbitrary commands as root on managed servers through the Database Backup feature. The flaw is caused by database names being inserted into shell commands without sanitization when backup jobs invoke mongodump, pg_dump, mysqldump, and mariadb-dump via docker exec; publicly available exploit code exists and EPSS is 0.20% (42nd percentile). The vendor-released patch is version 4.0.0-beta.451, and no CISA KEV confirmation was provided in the available data.
Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Rated low severity (CVSS 1.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Rated medium severity (CVSS 4.7), this vulnerability is low attack complexity. No vendor patch available.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Rated high severity (CVSS 8.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Rated high severity (CVSS 8.5), this vulnerability is low attack complexity. Public exploit code available.