CVE-2026-41899— Coolify unauthenticated feedback endpoint allows Discord webhook abuse
Quick assessment
Affected
coollabsio coolify
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
coolLabs Coolify是coolLabs团队开源的一个开源和自托管的 Heroku/Netlify/Vercel 替代品。 coolLabs Coolify 4.0.0-beta.474之前版本存在安全漏洞，该漏洞源于POST /api/feedback没有身份验证、没有速率限制且没有输入验证，允许任意内容直接转发到Discord webhook，从而导致垃圾信息、内容注入和webhook滥用。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| coollabsio | coolify | < 4.0.0-beta.474 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-41899
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Coolify unauthenticated feedback endpoint allows Discord webhook abuse
Source: CVE Program / CVE List V5
Vulnerability Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, POST /api/feedback has no authentication, no rate limiting, and no input validation, allowing arbitrary content to be forwarded directly to a Discord webhook and enabling spam, content injection, and webhook abuse. This issue is fixed in version 4.0.0-beta.474.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
coolLabs coolify 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
coolLabs Coolify是coolLabs团队开源的一个开源和自托管的 Heroku/Netlify/Vercel 替代品。 coolLabs Coolify 4.0.0-beta.474之前版本存在安全漏洞，该漏洞源于POST /api/feedback没有身份验证、没有速率限制且没有输入验证，允许任意内容直接转发到Discord webhook，从而导致垃圾信息、内容注入和webhook滥用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| coollabsio | coolify | < 4.0.0-beta.474 | - |
|
II. Public POCs for CVE-2026-41899
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-41899
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-41899 (2)
Vendor Advisories for CVE-2026-41899 (1)
Same Patch Batch · coollabsio · 2026-07-06 · 11 CVEs total
| CVE-2026-34038 | 9.9 CRITICAL | Coolify authenticated remote command injection leading to RCE and secret exfiltration |
| CVE-2026-42204 | 8.8 HIGH | Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root |
| CVE-2026-42153 | 8.8 HIGH | Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container |
| CVE-2026-34153 | 8.8 HIGH | Coolify LocalFileVolume fs_path command injection enables RCE |
| CVE-2026-34599 | 8.8 HIGH | Coolify: Authenticated Remote Code Execution in GetLogs Livewire Component |
| CVE-2026-32718 | 6.5 MEDIUM | Coolify read-scoped API tokens can perform state-changing validation operations |
| CVE-2026-34050 | 6.5 MEDIUM | Coolify Settings/Updates Livewire component missing instance administrator authorization |
| CVE-2026-34167 | 5.0 MEDIUM | Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMo |
| CVE-2026-42148 | 3.8 LOW | Coolify: Command Injection via Unescaped Version String in Docker Build |
| CVE-2026-34049 | 3.3 LOW | Coolify: Command Injection via unsanitized MongoDB collection names in database backup |
IV. Related Vulnerabilities
Same product: coolify
-
CVE-2026-100746
coollabsio Coolify GitHub App Setup redirect missing authent -
CVE-2026-100744
coollabsio Coolify Route-Level Middleware CanUpdateResource. -
CVE-2026-86117
Coolify through 4.3.17 OAuth Account Takeover via Unverified -
CVE-2026-84694
Coolify before 4.2.0 Remote Code Execution via Environment V -
CVE-2026-15507
coollabsio Coolify Policy Policies authorization
Same vendor: coollabsio
-
CVE-2026-100746
coollabsio Coolify GitHub App Setup redirect missing authent -
CVE-2026-100744
coollabsio Coolify Route-Level Middleware CanUpdateResource. -
CVE-2026-86117
Coolify through 4.3.17 OAuth Account Takeover via Unverified -
CVE-2026-84694
Coolify before 4.2.0 Remote Code Execution via Environment V -
CVE-2026-15507
coollabsio Coolify Policy Policies authorization
Same weakness: CWE-306
-
CVE-2026-79977
WireGuard peer endpoint learned from unauthenticated transpo -
CVE-2026-55463
Goobi viewer: WebSocket endpoints lack server-side authentic -
CVE-2026-46651
Unauthenticated SSRF and local file inclusion via DownloadTa -
CVE-2026-57207
NetBox MCP Server: HTTP transport exposes all NetBox data wi -
CVE-2026-114357
DJI CrystalSky ZS600C ships ADB without authentication (ro.a
V. Comments for CVE-2026-41899
No comments yet