CVE-2026-121587— Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints

Quick assessment

Affected

coollabsio coolify

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Coolify 在 4.1.1 版本之前存在信息泄露漏洞，允许未认证的攻击者通过手动配置的 GitHub、GitLab、Bitbucket 和 Gitea Webhook，枚举所有团队中的应用名称。攻击者可以提交一个包含通配符或为空的仓库名称，并搭配常用分支（如），利用未转义的 LIKE 通配符，在签名验证之前获取所有匹配的应用名称。

CVSS 5.3 · Medium Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1047 · Windows Management Instrumentation T1592 · Gather Victim Host Information

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints

Source: CVE Program / CVE List V5

Vulnerability Description

Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams via manual GitHub, GitLab, Bitbucket and Gitea webhooks. Attackers can send a repository name of % or empty with a common branch like main, exploiting unescaped LIKE wildcards to receive every matching application name before signature verification.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

信息暴露

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
coollabsio	coolify	0 ~ 4.1.1	-

II. Public POCs for CVE-2026-121587

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121587

请登录查看更多情报信息。

Vendor Pages for CVE-2026-121587 (1)

🔗 Release v4.1.1 · coollabsio/coolify · GitHub release-notes

Other References for CVE-2026-121587 (5)

https://github.com/coollabsio/coolify/pull/10361 issue-tracking patch
https://github.com/coollabsio/coolify/commit/c1518ba1c0be36da42b6cef06df4b042f5733b01 patch
https://github.com/coollabsio/coolify/commit/809d9b21fa9609de2ce9b49bb838c079598da876 patch
https://github.com/coollabsio/coolify/blob/v4.1.0/app/Http/Controllers/Webhook/Github.php#L69 technical-description
https://www.vulncheck.com/advisories/coolify-before-4.1.1-application-name-enumeration-via-manual-webhook-endpoints third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121587

IV. Related Vulnerabilities

Same product: coolify

Same vendor: coollabsio

Same weakness: CWE-200