# CVE-2026-34198: Coolify account takeover via host header injection in password reset

Source: https://junglewise.ai/threats/cve-2026-34198-coolify-account-takeover-via-host-header-injection-in-password  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-34198 · Severity: medium · CVSS 5.3 · Published 2026-07-07

Coolify, an open-source tool for managing servers and applications, was found to have a security flaw in its password reset process. An attacker could trick the system into sending a password reset email that contains a link leading to a malicious website instead of the real Coolify dashboard. If a user clicks this link, the attacker can steal their login credentials and take over their account.

## Quick answers

**Is CVE-2026-34198 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34198 being exploited in the wild.

**How severe is CVE-2026-34198?** Medium severity, with a CVSS score of 5.3, published 7 July 2026.

**Which products and versions are affected?** coollabsio Coolify < 4.0.0-beta.471.

**Is there a fix for CVE-2026-34198?** A patch was published on 2026-03-28: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34198 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-34198?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Coolify prior to version 4.0.0-beta.471 is vulnerable to host header injection leading to account takeover. The TrustProxies middleware was configured to trust all proxies ($proxies = '*'), allowing the X-Forwarded-Host header to be accepted from any source. Simultaneously, the TrustHosts middleware failed to validate hosts due to a circular caching dependency. When a password reset is requested, the application generates the reset URL using the request-derived host rather than a static server-side configuration. An unauthenticated remote attacker can exploit this by sending a password reset request with a spoofed host header, causing the system to email the victim a reset link pointing to an attacker-controlled domain. This allows the attacker to capture the reset token and compromise the account. The issue is fixed in version 4.0.0-beta.471 by using server-side configuration for URL generation.

## Affected products

- coollabsio Coolify < 4.0.0-beta.471

## Timeline

- 2026-03-28: patched: Fix merged into main branch
- 2026-04-09: advisory: Release v4.0.0-beta.471 published
- 2026-07-07: disclosed: CVE published to NVD

## References

- [https://github.com/coollabsio/coolify/commit/98569e4edbfc316877c9e0d27ea89fab3c49e3bd](https://github.com/coollabsio/coolify/commit/98569e4edbfc316877c9e0d27ea89fab3c49e3bd)
- [https://github.com/coollabsio/coolify/pull/9193](https://github.com/coollabsio/coolify/pull/9193)
- [https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471](https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471)
- [https://github.com/coollabsio/coolify/security/advisories/GHSA-cgj8-7m5q-x5gv](https://github.com/coollabsio/coolify/security/advisories/GHSA-cgj8-7m5q-x5gv)