Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

coolify — Vulnerabilities & Security Advisories 78

All 78 CVE vulnerabilities found in coolify, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities affecting Coolify, a self-hosted open-source platform designed for deploying and managing applications on personal servers. The collection encompasses a wide spectrum of weaknesses identified in the software, including remote code execution flaws, privilege escalation issues, and configuration errors reported over the past several years. Visitors can utilize this resource to track official vendor advisories, analyze the characteristics of specific weakness classes impacting the platform, or review the complete historical record of security incidents associated with Coolify. By centralizing these critical details, the page provides a clear view of the product's evolving security posture without requiring users to navigate disparate sources or fragmented reports. The data presented here serves as a foundational reference for security professionals, system administrators, and developers seeking to understand potential risks and implement necessary mitigations. All entries are curated to ensure accuracy and relevance, focusing strictly on confirmed issues that have been publicly disclosed or privately reported to the maintainers. This compilation aims to support proactive defense strategies by offering immediate access to essential vulnerability intelligence, enabling stakeholders to make informed decisions regarding their infrastructure security.

Vendor: coollabsio

CVE ID Title CVSS Severity Published
CVE-2026-34599 Coolify: Authenticated Remote Code Execution in GetLogs Livewire Component CWE-78 8.8 High 2026-07-06
CVE-2026-42204 Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root CWE-78 8.8 High 2026-07-06
CVE-2026-42148 Coolify: Command Injection via Unescaped Version String in Docker Build CWE-78 3.8 Low 2026-07-06
CVE-2026-34153 Coolify LocalFileVolume fs_path command injection enables RCE CWE-78 8.8 High 2026-07-06
CVE-2026-41899 Coolify unauthenticated feedback endpoint allows Discord webhook abuse CWE-306 6.5 Medium 2026-07-06
CVE-2026-34050 Coolify Settings/Updates Livewire component missing instance administrator authorization CWE-862 6.5 Medium 2026-07-06
CVE-2026-32718 Coolify read-scoped API tokens can perform state-changing validation operations CWE-863 6.5 Medium 2026-07-06
CVE-2026-34038 Coolify authenticated remote command injection leading to RCE and secret exfiltration CWE-78 9.9 Critical 2026-07-06
CVE-2026-27957 Coolify: Authenticated RCE via command injection in CA certificate management feature CWE-78 8.8 High 2026-06-30
CVE-2026-27956 Coolify: Cross-team application domain enumeration via domains_by_server endpoint CWE-639 4.3 Medium 2026-06-30
CVE-2026-27955 Coolify: Command Injection via Single-Quote Breakout in `executeInDocker()` CWE-78 6.6 Medium 2026-06-30
CVE-2026-27883 Coolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosure CWE-639 5.0 Medium 2026-06-30
CVE-2026-27881 Coolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR) CWE-639 5.0 Medium 2026-06-30
CVE-2026-27882 Coolify: Timing Attack in GitLab Webhook Token Validation CWE-208 4.8 Medium 2026-06-30
CVE-2026-34592 Coolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and Infrastructure CWE-639 7.7 High 2026-06-29
CVE-2026-34594 Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management CWE-78 8.8 High 2026-06-29
CVE-2026-34597 Coolify: Authenticated Host RCE CWE-78 8.8 High 2026-06-29
CVE-2026-41896 Coolify: Unauthenticated Deployment Trigger via Webhook HMAC Bypass with Null Secret CWE-287 7.5 High 2026-06-29
CVE-2026-57498 Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers CWE-639 9.6 Critical 2026-06-29
CVE-2026-12815 coollabsio coolify Image Name os command injection CWE-78 6.3 Medium 2026-06-21
CVE-2025-64425 Coolify has host header injection in forgot password CWE-644 8.0 - 2026-01-05
CVE-2025-64424 Colify has command injection vulnerability in project git source CWE-77 8.8 - 2026-01-05
CVE-2025-64423 Coolify has a Privilege Escalation - low privileged users can see and use admin invitation links CWE-287 8.0 - 2026-01-05
CVE-2025-64422 Rate-limit bypass on login via X-Forwarded-Host header CWE-770 9.8 - 2026-01-05
CVE-2025-64421 Coolify has a privilege escalation - low privileged user can invite themselves as an admin user CWE-863 8.8 - 2026-01-05
CVE-2025-64420 Coolify members can see private key of root user CWE-522 10.0 Critical 2026-01-05
CVE-2025-64419 Coolify vulnerable to command injection via docker-compose.yaml parameters CWE-77 9.7 Critical 2026-01-05
CVE-2025-59955 Coolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpoint CWE-201 7.1 - 2026-01-05
CVE-2025-59158 Coolify has Stored XSS in Project Name CWE-116 5.4 - 2026-01-05
CVE-2025-59157 Coolify has Git Repository RCE CWE-78 10.0 Critical 2026-01-05

All 78 known CVE vulnerabilities affecting coolify with full Chinese analysis, references, and POCs where available.