CVE-2026-34170

Published: Jul 7, 2026Modified: Jul 7, 2026Deferred

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp api_url field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowing an authenticated user to configure a GitHub App source that causes Coolify to request internal services or cloud metadata endpoints. This issue is reported as fixed in version 4.0.0-beta.471.

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (2)

https://github.com/coollabsio/coolify/security/advisories/GHSA-3g6r-cxv5-3c7h

Source: security-advisories@github.com

https://github.com/coollabsio/coolify/security/advisories/GHSA-3g6r-cxv5-3c7h

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.