CVE-2026-34171: Coolify account takeover via CSRF in invitation endpoint

CVE-2026-34171 · Severity: high · CVSS 8 · Published 2026-07-07

Coolify, an open-source tool for managing servers and applications, contained a security flaw that could allow an attacker to take over a user's account. By tricking a logged-in user into clicking a specially crafted invitation link, an attacker could force a password reset to a value known only to the attacker. This could lead to unauthorized access to sensitive server configurations, application secrets, and deployment environments.

Technologies: Coollabs Coolify. Vendors: Coollabs.

Quick answers

Is CVE-2026-34171 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34171 being exploited in the wild.
How severe is CVE-2026-34171?
High severity, with a CVSS score of 8, published 7 July 2026.
Which products and versions are affected?
Coollabs Coolify < 4.0.0-beta.471.
Is there a fix for CVE-2026-34171?
A patch was published on 2026-03-26: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34171 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34171?
Check whether you run Coollabs Coolify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the invitation handling logic of Coolify. The 'acceptInvitation' function in 'Controller.php' processed state-changing password resets via a GET request when a 'reset-password' query parameter was present. Because GET requests lack CSRF protection, an attacker (such as a team admin) could craft a URL using a known invitation UUID and trick a victim into visiting it. This action resets the victim's password to a hash of the UUID, which is known to the attacker, leading to full account takeover. The issue was resolved in version 4.0.0-beta.471 by refactoring the invitation flow to use a POST request for state changes and implementing proper form validation.

Affected products

  • coollabsio Coolify < 4.0.0-beta.471

Timeline

  • 2026-03-26: patched: Fix committed to repository
  • 2026-07-02: advisory: GitHub Security Advisory published
  • 2026-07-07: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.