CVE-2026-34198: Coolify account takeover via host header injection in password reset

CVE-2026-34198 · Severity: medium · CVSS 5.3 · Published 2026-07-07

Coolify, an open-source tool for managing servers and applications, was found to have a security flaw in its password reset process. An attacker could trick the system into sending a password reset email that contains a link leading to a malicious website instead of the real Coolify dashboard. If a user clicks this link, the attacker can steal their login credentials and take over their account.

Quick answers

Is CVE-2026-34198 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34198 being exploited in the wild.
How severe is CVE-2026-34198?
Medium severity, with a CVSS score of 5.3, published 7 July 2026.
Which products and versions are affected?
coollabsio Coolify < 4.0.0-beta.471.
Is there a fix for CVE-2026-34198?
A patch was published on 2026-03-28: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34198 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34198?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Coolify prior to version 4.0.0-beta.471 is vulnerable to host header injection leading to account takeover. The TrustProxies middleware was configured to trust all proxies ($proxies = '*'), allowing the X-Forwarded-Host header to be accepted from any source. Simultaneously, the TrustHosts middleware failed to validate hosts due to a circular caching dependency. When a password reset is requested, the application generates the reset URL using the request-derived host rather than a static server-side configuration. An unauthenticated remote attacker can exploit this by sending a password reset request with a spoofed host header, causing the system to email the victim a reset link pointing to an attacker-controlled domain. This allows the attacker to capture the reset token and compromise the account. The issue is fixed in version 4.0.0-beta.471 by using server-side configuration for URL generation.

Affected products

  • coollabsio Coolify < 4.0.0-beta.471

Timeline

  • 2026-03-28: patched: Fix merged into main branch
  • 2026-04-09: advisory: Release v4.0.0-beta.471 published
  • 2026-07-07: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.