Coolify v4.0.0-beta.471 Security Changelog

Vulnerability Overview In Coolify v4.0.0-beta.471, several security vulnerabilities and fixes exist, primarily involving model mass assignment protection, server and project queries, log components, Docker network names, URL validation, password reset URL generation, input validation, random number generation, middleware groups, project lookup, port exposure, and mapping fields. Scope of Impact Model Mass Assignment Protection: All models. Server and Project Queries: Current team. Log Components: Lock attributes and input validation. Docker Network Names: Validation and escaping. URL Validation: Notification webhook field, password reset URL generation, install/build/start command fields, resource limits field, custom DNS server input, proxy redirection input, server advanced settings page, Sentinel configuration, database backup timeout, email configuration, database public port, and proxy timeout. Random Number Generation: Used for email verification codes. Middleware Groups: Moving admin routes. Project Lookup: Team-scoped lookup. Port Exposure and Mapping Fields: Input validation. Remediation 1. Model Mass Assignment Protection: - Harden model mass assignment protection. 2. Server and Project Queries: - Restrict server and project queries to the current team. 3. Log Components: - Harden log components by locking attributes and enforcing input validation. 4. Docker Network Names: - Add validation and escaping for Docker network names. 5. URL Validation: - Add URL validation for the notification webhook field. - Use server-side configuration for password reset URL generation. - Add input validation for install/build/start command fields. - Add input validation for the resource limits field. - Add IP validation for custom DNS server inputs. - Add URL validation for proxy redirection inputs. - Add input validation for the server advanced settings page. - Add input validation for Sentinel configuration. - Add input validation for database backup timeout. - Add input validation for email configuration. - Add input validation for database public port and proxy timeout. 6. Random Number Generation: - Use to generate email verification codes. 7. Middleware Groups: - Move admin routes to a middleware group. 8. Project Lookup: - Enforce team-scoped project lookup. 9. Port Exposure and Mapping Fields: - Add input validation for port exposure and port mapping fields. Other Fixes and Improvements Fixes: - Fix intermittent pre-deployment command failures. - Fix Grafana using FQDN instead of URL. - Fix listmonk db config env type. - Fix Langfuse initialization errors by pinning the ClockHouse version. - Fix missing UUID when cloning persistent volumes. - Fix redirect values not persisting in . - Fix cloud subscription notification links. - Fix slash branches in public repository URLs. - Fix shared environment variables resolving on the wrong server. - Fix database SSL state and cloning writes. - Fix auto-generated missing CA certificates during SSL regeneration. - Fix backup notification failures affecting backup status. - Fix backup retention execution and stale execution cleanup. - Fix password visibility toggle using Alpine state. - Fix GitHub branch status when refreshing repositories. Improvements: - Share server environment variables. - Refresh repositories on private GitHub apps. - Support Docker image tags for preview deployments. - Add repository retention options for the deployment API. - Implement exponential backoff for unreachable servers. - Improve UX for the single scheduled task view. - Add two-step confirmation for enabling self-registration. - Add public port timeout configuration for databases. - Make textarea monospace opt-in and improve multi-line toggling. New Contributors @mxswd @xidik12 @matfre Full Changelog v4.0.0-beta.470 Contributors mxswd, GauthierPLM, and 7 other contributors Assets 9 reactions --- Code Block No POC code or exploitation code is included on the page.

Goal Reached Thanks to every supporter — we hit 100%!

Coolify v4.0.0-beta.471 Security Changelog

More from this source