Approved changes feed: RSS · Atom
cpe:2.3:a:coollabsio:coolify:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Coollabsio (0a63f4c6-60bf-511a-8273-c4f273ca8593) |
|---|---|
| Product | Coolify (13fadc36-d45c-5d0f-b91c-85c8365f52e6) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-59734 |
vulnerable | 2026-07-29 01:03:17.572776 |
Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution
HIGH (8.8)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, Coolify's app/Jobs/ApplicationDeploymentJob.php generate_healthcheck_commands() function directly interpolated the health_check_host, health_check_method, and health_check_path parameters into shell commands without proper sanitization, allowing authenticated users to execute arbitrary commands inside deployment containers. This issue is fixed in version 4.0.0-beta.469.
Published: 2026-07-09T17:35:05.368Z
Updated: 2026-07-09T18:16:19.863Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-57498 |
vulnerable | 2026-07-29 01:00:29.836096 |
Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers
CRITICAL (9.6)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consistently validate server ownership with Server::whereTeamId($teamId) before any operation. However, multiple Livewire web UI components accept server_id and destination_uuid from URL query parameters without any team ownership validation, allowing cross-team resource deployment. This vulnerability is fixed in 4.0.0-beta.474.
Published: 2026-06-29T20:12:07.696Z
Updated: 2026-06-30T15:59:07.390Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42204 |
vulnerable | 2026-07-29 00:49:31.749897 |
Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root
HIGH (8.8)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELL_SAFE_COMMAND_PATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-deployment command fields, allowing an authenticated team member to inject shell commands that execute on the host. This issue is fixed in version 4.0.0-beta.474.
Published: 2026-07-06T21:17:16.800Z
Updated: 2026-07-07T14:47:36.729Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42201 |
vulnerable | 2026-07-29 00:49:31.747078 |
Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands
LOW (3.3)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, database credential fields (redis_password, keydb_password, dragonfly_password, clickhouse_admin_user, clickhouse_admin_password, postgres_user, mysql_user) are validated only as 'string' at the API layer, with zero shell-safety checks. These values are then interpolated directly into Docker Compose YAML command: strings without any escaping. This issue is fixed in version 4.0.0-beta.474.
Published: 2026-07-07T03:29:13.739Z
Updated: 2026-07-07T13:58:15.968Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42200 |
vulnerable | 2026-07-29 00:49:31.746763 |
Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE
HIGH (8.8)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL initialization script (generate_init_scripts() method in app/Actions/Database/StartPostgresql.php) filename handling did not sufficiently restrict paths, allowing an authenticated user to write files outside the intended directory and achieve command execution through database initialization. This issue is fixed in version 4.0.0-beta.474.
Published: 2026-07-07T02:48:04.402Z
Updated: 2026-07-07T12:49:05.094Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42172 |
vulnerable | 2026-07-29 00:49:31.719763 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42153 |
vulnerable | 2026-07-29 00:49:31.710800 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42148 |
vulnerable | 2026-07-29 00:49:31.707848 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42147 |
vulnerable | 2026-07-29 00:49:31.707679 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42145 |
vulnerable | 2026-07-29 00:49:31.706999 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42143 |
vulnerable | 2026-07-29 00:49:31.705136 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41899 |
vulnerable | 2026-07-29 00:49:31.538329 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41896 |
vulnerable | 2026-07-29 00:49:31.537082 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34599 |
vulnerable | 2026-07-29 00:43:24.316721 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34597 |
vulnerable | 2026-07-29 00:43:24.314783 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34594 |
vulnerable | 2026-07-29 00:43:24.306979 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34592 |
vulnerable | 2026-07-29 00:43:24.304437 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34198 |
vulnerable | 2026-07-29 00:43:23.690694 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34171 |
vulnerable | 2026-07-29 00:43:23.665162 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34170 |
vulnerable | 2026-07-29 00:43:23.665006 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34168 |
vulnerable | 2026-07-29 00:43:23.664757 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34167 |
vulnerable | 2026-07-29 00:43:23.664570 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34158 |
vulnerable | 2026-07-29 00:43:23.656589 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34153 |
vulnerable | 2026-07-29 00:43:23.652078 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34152 |
vulnerable | 2026-07-29 00:43:23.651747 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34149 |
vulnerable | 2026-07-29 00:43:23.651365 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34058 |
vulnerable | 2026-07-29 00:43:23.559888 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34057 |
vulnerable | 2026-07-29 00:43:23.559686 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34050 |
vulnerable | 2026-07-29 00:43:23.544993 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34049 |
vulnerable | 2026-07-29 00:43:23.544817 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34048 |
vulnerable | 2026-07-29 00:43:23.544531 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34047 |
vulnerable | 2026-07-29 00:43:23.544311 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34044 |
vulnerable | 2026-07-29 00:43:23.537633 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34038 |
vulnerable | 2026-07-29 00:43:23.527769 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34037 |
vulnerable | 2026-07-29 00:43:23.527449 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34035 |
vulnerable | 2026-07-29 00:43:23.524128 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34034 |
vulnerable | 2026-07-29 00:43:23.523869 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32718 |
vulnerable | 2026-07-29 00:40:25.395382 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27957 |
vulnerable | 2026-07-29 00:37:42.660805 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27956 |
vulnerable | 2026-07-29 00:37:42.660582 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27955 |
vulnerable | 2026-07-29 00:37:42.646212 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27883 |
vulnerable | 2026-07-29 00:35:00.705199 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27882 |
vulnerable | 2026-07-29 00:35:00.704972 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27881 |
vulnerable | 2026-07-29 00:35:00.704660 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15507 |
vulnerable | 2026-07-29 00:26:18.185369 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12815 |
vulnerable | 2026-07-29 00:23:32.630204 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66213 |
vulnerable | 2026-06-08 07:39:21.671458 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66212 |
vulnerable | 2026-06-08 07:39:21.635123 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66211 |
vulnerable | 2026-06-08 07:39:21.600771 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66210 |
vulnerable | 2026-06-08 07:39:21.571139 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66209 |
vulnerable | 2026-06-08 07:39:21.495338 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64425 |
vulnerable | 2026-06-08 07:39:19.100431 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64424 |
vulnerable | 2026-06-08 07:39:19.058344 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64423 |
vulnerable | 2026-06-08 07:39:19.008227 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64422 |
vulnerable | 2026-06-08 07:39:18.963116 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64421 |
vulnerable | 2026-06-08 07:39:18.914011 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64420 |
vulnerable | 2026-06-08 07:39:18.873353 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64419 |
vulnerable | 2026-06-08 07:39:18.482530 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-59955 |
vulnerable | 2026-06-08 07:35:23.512785 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-59158 |
vulnerable | 2026-06-08 07:35:20.472775 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-59157 |
vulnerable | 2026-06-08 07:35:20.432583 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-59156 |
vulnerable | 2026-06-08 07:35:20.066711 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-24025 |
vulnerable | 2026-06-08 07:12:47.368318 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-22612 |
vulnerable | 2026-06-08 07:10:54.067184 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-22611 |
vulnerable | 2026-06-08 07:10:54.022043 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-22610 |
vulnerable | 2026-06-08 07:10:53.988245 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-22609 |
vulnerable | 2026-06-08 07:10:53.943261 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-22608 |
vulnerable | 2026-06-08 07:10:53.899956 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-22607 |
vulnerable | 2026-06-08 07:10:53.729667 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-22606 |
vulnerable | 2026-06-08 07:10:53.724524 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-22605 |
vulnerable | 2026-06-08 07:10:53.494863 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.