Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the TrustProxies middleware trusts all proxies ($proxies = '*'), accepting X-Forwarded-Host from any source. The TrustHosts middleware, intended to prevent host header attacks, has a circular caching dependency that prevents it from ever validating hosts. When a password reset is requested, the ResetPassword notification generates the reset URL using url(route(..., false)), which derives the host from the (spoofable) request. An unauthenticated attacker can trigger a password reset email containing a link pointing to an attacker-controlled domain, enabling token theft and account takeover. This issue is fixed in version 4.0.0-beta.471.
Published: 2026-07-07
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is caused by the TrustProxies middleware automatically trusting all proxy requests and accepting an X-Forwarded-Host header from any source, while the TrustHosts middleware fails to validate hosts due to a circular caching dependency. When a user requests a password reset, the reset URL is constructed from the host value supplied by the request. An unauthenticated attacker can therefore send a forged X-Forwarded-Host header to generate a reset email that points to an attacker-controlled domain. The attacker can capture the token and complete the reset process, gaining full control of the victim’s account. This satisfies weaknesses classified as CWE-346 (Untrusted Content Serving) and CWE-640 (Trusting of an Untrusted Delegated Proxy).

Affected Systems

Any deployment of Coolify before version 4.0.0-beta.471 is affected. The vulnerable components reside within the Coolify platform provided by coollabsio.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. With an EPSS score less than 1 % and no listing in the CISA KEV catalog, there is no evidence of confirmed exploitation yet. The attack can be executed remotely via a standard HTTP request that includes a forged X-Forwarded-Host header; no authentication is required to trigger the password-reset flow.

Generated by OpenCVE AI on July 26, 2026 at 19:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Coolify to version 4.0.0-beta.471 or later, where proxy trust is limited and the host‑validation bug is fixed.
  • If an immediate upgrade is not possible, reconfigure the TrustProxies setting to accept only known proxy IP addresses or set the proxy list to an empty set, and enable the TrustHosts middleware so that the host header is validated against the expected domain.
  • Consider disabling or strictly validating the X-Forwarded-Host header entirely to prevent spoofing of the host value used in password‑reset URLs.

Generated by OpenCVE AI on July 26, 2026 at 19:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 07 Jul 2026 05:00:00 +0000

Type Values Removed Values Added
First Time appeared Coollabsio
Coollabsio coolify
Vendors & Products Coollabsio
Coollabsio coolify

Tue, 07 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Description Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the TrustProxies middleware trusts all proxies ($proxies = '*'), accepting X-Forwarded-Host from any source. The TrustHosts middleware, intended to prevent host header attacks, has a circular caching dependency that prevents it from ever validating hosts. When a password reset is requested, the ResetPassword notification generates the reset URL using url(route(..., false)), which derives the host from the (spoofable) request. An unauthenticated attacker can trigger a password reset email containing a link pointing to an attacker-controlled domain, enabling token theft and account takeover. This issue is fixed in version 4.0.0-beta.471.
Title Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing
Weaknesses CWE-346
CWE-640
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N'}

Subscriptions

Coollabsio Coolify
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-07T13:36:25.549Z

Reserved: 2026-03-26T15:57:52.323Z

Link: CVE-2026-34198

cve-icon Vulnrichment

Updated: 2026-07-07T13:36:20.642Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T20:00:04Z

Weaknesses
  • CWE-346

    Origin Validation Error

  • CWE-640

    Weak Password Recovery Mechanism for Forgotten Password