Is CVE-2026-34170 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34170 being exploited in the wild.

How severe is CVE-2026-34170?

Medium severity, with a CVSS score of 4.3, published 7 July 2026.

Which products and versions are affected?

coollabsio Coolify < 4.0.0-beta.471.

Is there a fix for CVE-2026-34170?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-34170 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-34170?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34170: coollabsio Coolify SSRF in GitHub App configuration

Q: Which products and versions are affected?

coollabsio Coolify < 4.0.0-beta.471.

Q: Is there a fix for CVE-2026-34170?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-34170 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-34170?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34170 · Severity: medium · CVSS 4.3 · Published 2026-07-07

Coolify, an open-source tool for managing servers and applications, contains a vulnerability that allows authenticated users to redirect the server's internal requests. By providing a malicious URL in the GitHub App configuration, an attacker can force the Coolify server to interact with internal network services or cloud metadata endpoints that are normally protected. This could lead to the exposure of sensitive internal configuration data or information about the hosting environment.

Quick answers

Is CVE-2026-34170 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34170 being exploited in the wild.
How severe is CVE-2026-34170?: Medium severity, with a CVSS score of 4.3, published 7 July 2026.
Which products and versions are affected?: coollabsio Coolify < 4.0.0-beta.471.
Is there a fix for CVE-2026-34170?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-34170 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34170?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Coolify prior to version 4.0.0-beta.471 due to insufficient validation of the 'api_url' field in the GitHub App model. The application fails to implement allowlisting or private IP blocking for this field, which is subsequently used as a base URL for server-side HTTP requests via the 'Http::GitHub' macro and various helper functions (e.g., updateGithubAppName, generateGithubToken). An authenticated attacker can configure a GitHub App source pointing to internal IP addresses (e.g., 127.0.0.1, 169.254.169.254) to probe internal services or cloud metadata. While the impact is partially mitigated by fixed path suffixes like '/app' or '/zen', error messages may leak information from the internal responses. The issue is fixed in version 4.0.0-beta.471.

Affected products

coollabsio Coolify < 4.0.0-beta.471

Timeline

2026-07-02: advisory: GitHub Security Advisory published
2026-07-07: disclosed: CVE published to NVD

References

https://github.com/coollabsio/coolify/security/advisories/GHSA-3g6r-cxv5-3c7h

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.