Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, S3 storage endpoint validation only checks URL format and testConnection() sends a server-side request to the configured endpoint, allowing an authenticated user with storage management permissions to make Coolify request internal or metadata-service URLs. This issue is fixed in version 4.0.0-beta.474.
Published: 2026-07-07
Score: 4.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a server‑side request forgery (CWE‑918) that occurs when Coolify’s S3 storage endpoint validation only checks URL format. During testConnection(), the application makes a server‑side HTTP request to the configured endpoint, which can be pointed to internal or cloud metadata‑service URLs. An authenticated user with storage‑management permissions can exploit this to discover internal resources or retrieve metadata, potentially aiding further attacks.

Affected Systems

The product affected is Coolify from CoollabsIO. Any installation running a version earlier than 4.0. 4.0.0‑beta.474 and newer contain the fix.

Risk and Exploitability

The CVSS score of 4.9 indicates moderate severity. The EPSS score of < 1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. An attacker must first authenticate and possess storage‑management rights, but once those prerequisites are met the SSRF can be triggered with relative ease.

Generated by OpenCVE AI on July 26, 2026 at 19:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the patch by upgrading to Coolify 4.0.0‑beta.474 or any later release that includes the fix.
  • Limit storage‑management permissions to trusted accounts or roles to reduce the number of users who can trigger the SSRF.
  • If an upgrade is not immediately possible, restrict the server’s outbound network access or impose firewall rules that block connections to internal or metadata‑service endpoints from the application.

Generated by OpenCVE AI on July 26, 2026 at 19:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 07 Jul 2026 05:00:00 +0000

Type Values Removed Values Added
First Time appeared Coollabsio
Coollabsio coolify
Vendors & Products Coollabsio
Coollabsio coolify

Tue, 07 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Description Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, S3 storage endpoint validation only checks URL format and testConnection() sends a server-side request to the configured endpoint, allowing an authenticated user with storage management permissions to make Coolify request internal or metadata-service URLs. This issue is fixed in version 4.0.0-beta.474.
Title Coolify: SSRF via S3 Storage Endpoint in testConnection()
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Coollabsio Coolify
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-07T14:33:48.769Z

Reserved: 2026-04-24T17:15:21.834Z

Link: CVE-2026-42147

cve-icon Vulnrichment

Updated: 2026-07-07T14:33:09.487Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T19:45:03Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)