CVE-2026-42147

Published: Jul 7, 2026Modified: Jul 7, 2026Deferred

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.2 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, S3 storage endpoint validation only checks URL format and testConnection() sends a server-side request to the configured endpoint, allowing an authenticated user with storage management permissions to make Coolify request internal or metadata-service URLs. This issue is fixed in version 4.0.0-beta.474.

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (4)

https://github.com/coollabsio/coolify/commit/297e9c41e19958f6237919794c28c3fb1d4cda32

Source: security-advisories@github.com

https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.474

Source: security-advisories@github.com

https://github.com/coollabsio/coolify/security/advisories/GHSA-pwm4-w33c-wjf3

Source: security-advisories@github.com

https://github.com/coollabsio/coolify/security/advisories/GHSA-pwm4-w33c-wjf3

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.