Executive brief
Coolify, an open-source tool for managing servers and applications, contains a vulnerability that allows authenticated users to redirect the server's internal requests. By providing a malicious URL in the GitHub App configuration, an attacker can force the Coolify server to interact with internal network services or cloud metadata endpoints that are normally protected. This could lead to the exposure of sensitive internal configuration data or information about the hosting environment.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Coolify prior to version 4.0.0-beta.471 due to insufficient validation of the 'api_url' field in the GitHub App model. The application fails to implement allowlisting or private IP blocking for this field, which is subsequently used as a base URL for server-side HTTP requests via the 'Http::GitHub' macro and various helper functions (e.g., updateGithubAppName, generateGithubToken). An authenticated attacker can configure a GitHub App source pointing to internal IP addresses (e.g., 127.0.0.1, 169.254.169.254) to probe internal services or cloud metadata. While the impact is partially mitigated by fixed path suffixes like '/app' or '/zen', error messages may leak information from the internal responses. The issue is fixed in version 4.0.0-beta.471.
Affected products
- coollabsio Coolify < 4.0.0-beta.471
Timeline
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-07: disclosed: CVE published to NVD