CVE-2026-100746— coollabsio Coolify GitHub App Setup redirect missing authentication
Quick assessment
Affected
coollabsio Coolify
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 coollabsio Coolify 版本 4.1.0 及更早版本中发现一个安全漏洞。该漏洞影响组件“GitHub App Setup Handler”中文件 的 函数。通过对参数 进行操控，可导致身份验证缺失。此攻击可远程执行，且相关利用代码已被公开，可被利用。通过升级至版本 4.1.1 可缓解此问题，该补丁的提交标识为 。建议受影响组件的部署方尽快进行升级。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100746
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
coollabsio Coolify GitHub App Setup redirect missing authentication
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App Setup Handler. The manipulation of the argument state results in missing authentication. The attack can be executed remotely. The exploit has been made public and could be used. Upgrading to version 4.1.1 mitigates this issue. The patch is identified as fc89e357feed5180ed1ab5eb9cb330578f025539. The affected component should be upgraded.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| coollabsio | Coolify | 4.0 |
cpe:2.3:a:coollabsio:coolify:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-100746
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100746
请登录查看更多情报信息。
Other References for CVE-2026-100746 (9)
-
-
https://vuldb.com/cve/CVE-2026-100746 third-party-advisory
-
-
https://vuldb.com/submit/897404 third-party-advisory
-
IV. Related Vulnerabilities
Same product: Coolify
-
CVE-2026-100744
coollabsio Coolify Route-Level Middleware CanUpdateResource. -
CVE-2026-86117
Coolify through 4.3.17 OAuth Account Takeover via Unverified -
CVE-2026-84694
Coolify before 4.2.0 Remote Code Execution via Environment V -
CVE-2026-15507
coollabsio Coolify Policy Policies authorization -
CVE-2026-59734
Coolify: OS Command Injection in Health Check Configuration
Same vendor: coollabsio
-
CVE-2026-100744
coollabsio Coolify Route-Level Middleware CanUpdateResource. -
CVE-2026-86117
Coolify through 4.3.17 OAuth Account Takeover via Unverified -
CVE-2026-84694
Coolify before 4.2.0 Remote Code Execution via Environment V -
CVE-2026-15507
coollabsio Coolify Policy Policies authorization -
CVE-2026-59734
Coolify: OS Command Injection in Health Check Configuration
Same weakness: CWE-306
-
CVE-2026-52748
Missing authentication for backup functionality in Kaon AR21 -
CVE-2026-82930
Missing Authentication in mH-DEVELOPER -
CVE-2026-82383
Apache Roller: Anonymous setup action allows frontpage confi -
CVE-2026-101004
notionnext-org NotionNext Authentication Guard cache.js clea -
CVE-2026-100903
ООО НПО Ритм GEOritm REST API obj-groups missing authenticat
V. Comments for CVE-2026-100746
No comments yet