Executive brief
Coolify is an open-source platform used to manage and deploy servers, applications, and databases. A security flaw in how it handles webhooks allows unauthorized individuals to bypass security checks and trigger application deployments. This could lead to service disruptions or the deployment of unauthorized code if an attacker can manipulate the deployment source.
Technical details
An authentication bypass exists in Coolify's webhook controllers (GitHub, Bitbucket, and Gitea) due to improper handling of null HMAC secrets. The 'manual_webhook_secret_github' field is nullable and defaults to null for new applications. In PHP, the hash_hmac() function silently coerces a null key into an empty string. Consequently, an unauthenticated remote attacker can calculate a valid HMAC signature for any payload by using an empty string as the key. By providing this deterministic signature in the 'X-Hub-Signature-256' header, the attacker can bypass signature verification and trigger arbitrary application deployments. The vulnerability is fixed in version 4.0.0-beta.474.
Affected products
- coollabsio Coolify < 4.0.0-beta.474
Timeline
- 2026-06-25: advisory: GitHub Security Advisory published
- 2026-06-29: disclosed: CVE published to NVD