# coollabsio coolify. Every CVE that names coollabsio coolify among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints](https://agentprime.io/advisories/CVE-2026-121587.md) `CVE-2026-121587` · CVE record: coollabsio coolify · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [coollabsio Coolify GitHub App Setup redirect missing authentication](https://agentprime.io/advisories/CVE-2026-100746.md) `CVE-2026-100746` · CVE record: coollabsio Coolify · CVSS 6.9 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Authentication bypass - [coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization](https://agentprime.io/advisories/CVE-2026-100744.md) `CVE-2026-100744` · CVE record: coollabsio Coolify · CVSS 6.9 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Broken access control - [Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching](https://agentprime.io/advisories/CVE-2026-86117.md) `CVE-2026-86117` · CVE record: coollabsio coolify · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Authentication bypass - [Coolify before 4.2.0 Remote Code Execution via Environment Variable Key](https://agentprime.io/advisories/CVE-2026-84694.md) `CVE-2026-84694` · CVE record: coollabsio coolify · CVSS 8.7 High · Not analysed yet · Published 2 Sept 2026 · Tags: Command injection - [coollabsio Coolify Policy Policies authorization](https://agentprime.io/advisories/CVE-2026-15507.md) `CVE-2026-15507` · CVE record: coollabsio Coolify · CVSS 5.3 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Broken access control - [Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution](https://agentprime.io/advisories/CVE-2026-59734.md) `CVE-2026-59734` · CVE record: coollabsio coolify · CVSS 8.8 High · Not analysed yet · Published 9 Jul 2026 · Tags: Command injection - [Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands](https://agentprime.io/advisories/CVE-2026-42201.md) `CVE-2026-42201` · CVE record: coollabsio coolify · CVSS 3.3 Low · Not analysed yet · Published 7 Jul 2026 · Tags: Command injection - [Coolify: Command injection via single-quote breakout in Docker Compose custom commands](https://agentprime.io/advisories/CVE-2026-34158.md) `CVE-2026-34158` · CVE record: coollabsio coolify · CVSS 8.8 High · Not analysed yet · Published 7 Jul 2026 · Tags: Command injection - [Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL](https://agentprime.io/advisories/CVE-2026-34170.md) `CVE-2026-34170` · CVE record: coollabsio coolify · CVSS 4.3 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Server-side request forgery (SSRF) - [Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()](https://agentprime.io/advisories/CVE-2026-34037.md) `CVE-2026-34037` · CVE record: coollabsio coolify · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jul 2026 · Tags: Broken access control - [Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers](https://agentprime.io/advisories/CVE-2026-34048.md) `CVE-2026-34048` · CVE record: coollabsio coolify · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jul 2026 · Tags: Broken access control - [Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name](https://agentprime.io/advisories/CVE-2026-34057.md) `CVE-2026-34057` · CVE record: coollabsio coolify · CVSS 8.8 High · Not analysed yet · Published 7 Jul 2026 · Tags: Command injection - [Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers](https://agentprime.io/advisories/CVE-2026-42143.md) `CVE-2026-42143` · CVE record: coollabsio coolify · CVSS 8.8 High · Not analysed yet · Published 7 Jul 2026 · Tags: Command injection - [Coolify: SSRF via S3 Storage Endpoint in testConnection()](https://agentprime.io/advisories/CVE-2026-42147.md) `CVE-2026-42147` · CVE record: coollabsio coolify · CVSS 4.9 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Server-side request forgery (SSRF) - [Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped)](https://agentprime.io/advisories/CVE-2026-34044.md) `CVE-2026-34044` · CVE record: coollabsio coolify · CVSS 7.7 High · Not analysed yet · Published 7 Jul 2026 · Tags: Broken access control - [Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport)](https://agentprime.io/advisories/CVE-2026-34152.md) `CVE-2026-34152` · CVE record: coollabsio coolify · CVSS 8.8 High · Not analysed yet · Published 7 Jul 2026 · Tags: Command injection - [Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs](https://agentprime.io/advisories/CVE-2026-34149.md) `CVE-2026-34149` · CVE record: coollabsio coolify · CVSS 3.3 Low · Not analysed yet · Published 7 Jul 2026 · Tags: Command injection - [Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value](https://agentprime.io/advisories/CVE-2026-34171.md) `CVE-2026-34171` · CVE record: coollabsio coolify · CVSS 8.0 High · Not analysed yet · Published 7 Jul 2026 · Tags: Cross-site request forgery (CSRF) - [Coolify: Host RCE via Sentinel token injection](https://agentprime.io/advisories/CVE-2026-34034.md) `CVE-2026-34034` · CVE record: coollabsio coolify · CVSS 8.8 High · Not analysed yet · Published 7 Jul 2026 · Tags: Command injection - [Coolify: Command injection via unsanitized persistent storage name in docker volume commands](https://agentprime.io/advisories/CVE-2026-34168.md) `CVE-2026-34168` · CVE record: coollabsio coolify · CVSS 8.8 High · Not analysed yet · Published 7 Jul 2026 · Tags: Command injection - [Coolify: File Upload Without Type or Size Validation in Database Backup Restore](https://agentprime.io/advisories/CVE-2026-42145.md) `CVE-2026-42145` · CVE record: coollabsio coolify · CVSS 3.1 Low · Not analysed yet · Published 7 Jul 2026 · Tags: Unrestricted file upload, Denial of service - [Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing](https://agentprime.io/advisories/CVE-2026-34198.md) `CVE-2026-34198` · CVE record: coollabsio coolify · CVSS 5.3 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: CWE-346, CWE-640 - [Coolify: OS Command Injection via Unmanaged Container Operations - Remote Code Execution](https://agentprime.io/advisories/CVE-2026-34058.md) `CVE-2026-34058` · CVE record: coollabsio coolify · CVSS 8.8 High · Not analysed yet · Published 7 Jul 2026 · Tags: Command injection - [Coolify: Host RCE via Log Drain secret/env command injection](https://agentprime.io/advisories/CVE-2026-34035.md) `CVE-2026-34035` · CVE record: coollabsio coolify · CVSS 8.8 High · Not analysed yet · Published 7 Jul 2026 · Tags: Command injection - [Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-34047.md) `CVE-2026-34047` · CVE record: coollabsio coolify · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jul 2026 · Tags: Broken access control - [Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Access](https://agentprime.io/advisories/CVE-2026-42172.md) `CVE-2026-42172` · CVE record: coollabsio coolify · CVSS 3.1 Low · Not analysed yet · Published 7 Jul 2026 · Tags: Authentication bypass - [Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE](https://agentprime.io/advisories/CVE-2026-42200.md) `CVE-2026-42200` · CVE record: coollabsio coolify · CVSS 8.8 High · Not analysed yet · Published 7 Jul 2026 · Tags: Path traversal - [Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container](https://agentprime.io/advisories/CVE-2026-42153.md) `CVE-2026-42153` · CVE record: coollabsio coolify · CVSS 8.8 High · Not analysed yet · Published 6 Jul 2026 · Tags: Command injection - [Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor](https://agentprime.io/advisories/CVE-2026-34167.md) `CVE-2026-34167` · CVE record: coollabsio coolify · CVSS 5.0 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Broken access control - [Coolify: Command Injection via unsanitized MongoDB collection names in database backup](https://agentprime.io/advisories/CVE-2026-34049.md) `CVE-2026-34049` · CVE record: coollabsio coolify · CVSS 3.3 Low · Not analysed yet · Published 6 Jul 2026 · Tags: Command injection - [Coolify: Authenticated Remote Code Execution in GetLogs Livewire Component](https://agentprime.io/advisories/CVE-2026-34599.md) `CVE-2026-34599` · CVE record: coollabsio coolify · CVSS 8.8 High · Not analysed yet · Published 6 Jul 2026 · Tags: Command injection - [Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root](https://agentprime.io/advisories/CVE-2026-42204.md) `CVE-2026-42204` · CVE record: coollabsio coolify · CVSS 8.8 High · Not analysed yet · Published 6 Jul 2026 · Tags: Command injection - [Coolify: Command Injection via Unescaped Version String in Docker Build](https://agentprime.io/advisories/CVE-2026-42148.md) `CVE-2026-42148` · CVE record: coollabsio coolify · CVSS 3.8 Low · Not analysed yet · Published 6 Jul 2026 · Tags: Command injection - [Coolify LocalFileVolume fs_path command injection enables RCE](https://agentprime.io/advisories/CVE-2026-34153.md) `CVE-2026-34153` · CVE record: coollabsio coolify · CVSS 8.8 High · Not analysed yet · Published 6 Jul 2026 · Tags: Command injection - [Coolify unauthenticated feedback endpoint allows Discord webhook abuse](https://agentprime.io/advisories/CVE-2026-41899.md) `CVE-2026-41899` · CVE record: coollabsio coolify · CVSS 6.5 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Authentication bypass, Denial of service - [Coolify Settings/Updates Livewire component missing instance administrator authorization](https://agentprime.io/advisories/CVE-2026-34050.md) `CVE-2026-34050` · CVE record: coollabsio coolify · CVSS 6.5 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Broken access control - [Coolify read-scoped API tokens can perform state-changing validation operations](https://agentprime.io/advisories/CVE-2026-32718.md) `CVE-2026-32718` · CVE record: coollabsio coolify · CVSS 6.5 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Broken access control - [Coolify authenticated remote command injection leading to RCE and secret exfiltration](https://agentprime.io/advisories/CVE-2026-34038.md) `CVE-2026-34038` · CVE record: coollabsio coolify · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: Command injection - [Coolify: Authenticated RCE via command injection in CA certificate management feature](https://agentprime.io/advisories/CVE-2026-27957.md) `CVE-2026-27957` · CVE record: coollabsio coolify · CVSS 8.8 High · Not analysed yet · Published 30 Jun 2026 · Tags: Command injection - [Coolify: Cross-team application domain enumeration via domains_by_server endpoint](https://agentprime.io/advisories/CVE-2026-27956.md) `CVE-2026-27956` · CVE record: coollabsio coolify · CVSS 4.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Broken access control - [Coolify: Command Injection via Single-Quote Breakout in \`executeInDocker()\`](https://agentprime.io/advisories/CVE-2026-27955.md) `CVE-2026-27955` · CVE record: coollabsio coolify · CVSS 6.6 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Command injection - [Coolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosure](https://agentprime.io/advisories/CVE-2026-27883.md) `CVE-2026-27883` · CVE record: coollabsio coolify · CVSS 5.0 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Broken access control - [Coolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR)](https://agentprime.io/advisories/CVE-2026-27881.md) `CVE-2026-27881` · CVE record: coollabsio coolify · CVSS 5.0 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Broken access control - [Coolify: Timing Attack in GitLab Webhook Token Validation](https://agentprime.io/advisories/CVE-2026-27882.md) `CVE-2026-27882` · CVE record: coollabsio coolify · CVSS 4.8 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-208 - [Coolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and Infrastructure](https://agentprime.io/advisories/CVE-2026-34592.md) `CVE-2026-34592` · CVE record: coollabsio coolify · CVSS 7.7 High · Not analysed yet · Published 29 Jun 2026 · Tags: Broken access control - [Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management](https://agentprime.io/advisories/CVE-2026-34594.md) `CVE-2026-34594` · CVE record: coollabsio coolify · CVSS 8.8 High · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection - [Coolify: Authenticated Host RCE](https://agentprime.io/advisories/CVE-2026-34597.md) `CVE-2026-34597` · CVE record: coollabsio coolify · CVSS 8.8 High · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection - [Coolify: Unauthenticated Deployment Trigger via Webhook HMAC Bypass with Null Secret](https://agentprime.io/advisories/CVE-2026-41896.md) `CVE-2026-41896` · CVE record: coollabsio coolify · CVSS 7.5 High · Not analysed yet · Published 29 Jun 2026 · Tags: Authentication bypass - [Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers](https://agentprime.io/advisories/CVE-2026-57498.md) `CVE-2026-57498` · CVE record: coollabsio coolify · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Broken access control - [coollabsio coolify Image Name os command injection](https://agentprime.io/advisories/CVE-2026-12815.md) `CVE-2026-12815` · CVE record: coollabsio coolify · CVSS 5.3 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Command injection - [Coolify has host header injection in forgot password](https://agentprime.io/advisories/CVE-2025-64425.md) `CVE-2025-64425` · CVE record: coollabsio coolify · CVSS 8.5 High · Not analysed yet · Published 5 Jan 2026 · Tags: CWE-644 - [Colify has command injection vulnerability in project git source](https://agentprime.io/advisories/CVE-2025-64424.md) `CVE-2025-64424` · CVE record: coollabsio coolify · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Jan 2026 · Tags: Command injection - [Coolify has a Privilege Escalation - low privileged users can see and use admin invitation links](https://agentprime.io/advisories/CVE-2025-64423.md) `CVE-2025-64423` · CVE record: coollabsio coolify · CVSS 7.7 High · Not analysed yet · Published 5 Jan 2026 · Tags: Authentication bypass - [Rate-limit bypass on login via X-Forwarded-Host header](https://agentprime.io/advisories/CVE-2025-64422.md) `CVE-2025-64422` · CVE record: coollabsio coolify · CVSS 5.5 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: Denial of service - [Coolify has a privilege escalation - low privileged user can invite themselves as an admin user](https://agentprime.io/advisories/CVE-2025-64421.md) `CVE-2025-64421` · CVE record: coollabsio coolify · CVSS 8.7 High · Not analysed yet · Published 5 Jan 2026 · Tags: Broken access control - [Coolify members can see private key of root user](https://agentprime.io/advisories/CVE-2025-64420.md) `CVE-2025-64420` · CVE record: coollabsio coolify · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Jan 2026 · Tags: Hard-coded credentials - [Coolify vulnerable to command injection via docker-compose.yaml parameters](https://agentprime.io/advisories/CVE-2025-64419.md) `CVE-2025-64419` · CVE record: coollabsio coolify · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Jan 2026 · Tags: Command injection - [Coolify leaksensitive information \`email_change_code\` in \`/api/v1/teams/{team_id | current}/members\` API endpoint](https://agentprime.io/advisories/CVE-2025-59955.md) `CVE-2025-59955` · CVE record: coollabsio coolify · CVSS 5.7 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: Information disclosure, CWE-212, CWE-214 - [Coolify has Stored XSS in Project Name](https://agentprime.io/advisories/CVE-2025-59158.md) `CVE-2025-59158` · CVE record: coollabsio coolify · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Jan 2026 · Tags: CWE-116 Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .