# Coollabs vulnerabilities Source: https://junglewise.ai/threats/vendors/coollabs Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/coollabs.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 52 vulnerabilities in Coollabs: 0 in the last 7 days and 1 in the last 90 days, 6 of them critical and 0 exploited in the wild. The most recent, CVE-2026-121587, was published on 3 November 2026. 1 vulnerability in the last four weeks, up from none in the four before. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 1 - All time: 52 (6 critical, 0 exploited in the wild) ## About Coollabs The organization behind the Coolify self-hosting platform. ## Latest Coollabs vulnerabilities - [CVE-2026-121587: Coolify information disclosure via webhook enumeration](https://junglewise.ai/threats/cve-2026-121587-coolify-before-4-1-1-contains-an-information-disclosure) (medium, CVSS 5.3, published 3 Nov 2026) - [CVE-2026-15507: coollabsio Coolify missing authorization in Policy Handler](https://junglewise.ai/threats/cve-2026-15507-coollabsio-coolify-missing-authorization-in-policy-handler) (medium, CVSS 6.3, published 12 Jul 2026) - [CVE-2026-59734: Coollabs Coolify OS command injection in health check configuration](https://junglewise.ai/threats/cve-2026-59734-coollabs-coolify-os-command-injection-in-health-check) (high, CVSS 8.8, published 9 Jul 2026) - [CVE-2026-42201: Coolify OS command injection in database credential fields](https://junglewise.ai/threats/cve-2026-42201-coolify-os-command-injection-in-database-credential-fields) (low, CVSS 3.3, published 7 Jul 2026) - [CVE-2026-34158: Coolabsio Coolify OS command injection in Docker Compose commands](https://junglewise.ai/threats/cve-2026-34158-coolabsio-coolify-os-command-injection-in-docker-compose-commands) (high, CVSS 8.8, published 7 Jul 2026) - [CVE-2026-42200: Coollabsio Coolify path traversal in PostgreSQL init scripts](https://junglewise.ai/threats/cve-2026-42200-coollabsio-coolify-path-traversal-in-postgresql-init-scripts) (high, CVSS 8.8, published 7 Jul 2026) - [CVE-2026-42172: Coollabs Coolify insufficient session expiration for API tokens](https://junglewise.ai/threats/cve-2026-42172-coollabs-coolify-insufficient-session-expiration-for-api-tokens) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2026-42147: Coollabsio Coolify SSRF in S3 storage endpoint validation](https://junglewise.ai/threats/cve-2026-42147-coollabsio-coolify-ssrf-in-s3-storage-endpoint-validation) (medium, CVSS 4.9, published 7 Jul 2026) - [CVE-2026-42145: Coollabsio Coolify unrestricted file upload in database backup restore](https://junglewise.ai/threats/cve-2026-42145-coollabsio-coolify-unrestricted-file-upload-in-database-backup) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2026-42143: Coollabsio Coolify OS command injection in persistent volume names](https://junglewise.ai/threats/cve-2026-42143-coollabsio-coolify-os-command-injection-in-persistent-volume) (high, CVSS 8.8, published 7 Jul 2026) - [CVE-2026-34198: Coolify account takeover via host header injection in password reset](https://junglewise.ai/threats/cve-2026-34198-coolify-account-takeover-via-host-header-injection-in-password) (medium, CVSS 5.3, published 7 Jul 2026) - [CVE-2026-34171: Coolify account takeover via CSRF in invitation endpoint](https://junglewise.ai/threats/cve-2026-34171-coolify-account-takeover-via-csrf-in-invitation-endpoint) (high, CVSS 8, published 7 Jul 2026) - [CVE-2026-34170: coollabsio Coolify SSRF in GitHub App configuration](https://junglewise.ai/threats/cve-2026-34170-coollabsio-coolify-ssrf-in-github-app-configuration) (medium, CVSS 4.3, published 7 Jul 2026) - [CVE-2026-34168: Coollabs Coolify OS command injection in LocalPersistentVolume name](https://junglewise.ai/threats/cve-2026-34168-coollabs-coolify-os-command-injection-in-localpersistentvolume) (high, CVSS 8.8, published 7 Jul 2026) - [CVE-2026-34152: Coolabsio Coolify OS command injection in deployment commands](https://junglewise.ai/threats/cve-2026-34152-coolabsio-coolify-os-command-injection-in-deployment-commands) (high, CVSS 8.8, published 7 Jul 2026) - [CVE-2026-34149: Coolify OS command injection in DatabaseBackupJob](https://junglewise.ai/threats/cve-2026-34149-coolify-os-command-injection-in-databasebackupjob) (low, CVSS 3.3, published 7 Jul 2026) - [CVE-2026-34058: Coollabsio Coolify OS command injection in Server Resources](https://junglewise.ai/threats/cve-2026-34058-coollabsio-coolify-os-command-injection-in-server-resources) (high, CVSS 8.8, published 7 Jul 2026) - [CVE-2026-34057: Coolify command injection in database import component](https://junglewise.ai/threats/cve-2026-34057-coolify-command-injection-in-database-import-component) (high, CVSS 8.8, published 7 Jul 2026) - [CVE-2026-34048: Coolify improper authorization in terminal websocket routes](https://junglewise.ai/threats/cve-2026-34048-coolify-improper-authorization-in-terminal-websocket-routes) (critical, CVSS 9.9, published 7 Jul 2026) - [CVE-2026-34047: Coolify incorrect authorization in terminal WebSocket routes](https://junglewise.ai/threats/cve-2026-34047-coolify-incorrect-authorization-in-terminal-websocket-routes) (critical, CVSS 9.9, published 7 Jul 2026) - [CVE-2026-34044: Coolify IDOR in Logs component allows cross-team log access](https://junglewise.ai/threats/cve-2026-34044-coolify-idor-in-logs-component-allows-cross-team-log-access) (high, CVSS 7.7, published 7 Jul 2026) - [CVE-2026-34037: Coolify cross-tenant resource cloning in ResourceOperations.php](https://junglewise.ai/threats/cve-2026-34037-coolify-cross-tenant-resource-cloning-in-resourceoperations-php) (critical, CVSS 9.9, published 7 Jul 2026) - [CVE-2026-34035: coollabsio Coolify command injection in Log Drain configuration](https://junglewise.ai/threats/cve-2026-34035-coollabsio-coolify-command-injection-in-log-drain-configuration) (high, CVSS 8.8, published 7 Jul 2026) - [CVE-2026-34034: Coolify OS command injection in Sentinel token settings](https://junglewise.ai/threats/cve-2026-34034-coolify-os-command-injection-in-sentinel-token-settings) (high, CVSS 8.8, published 7 Jul 2026) - [CVE-2026-42204: Coolify OS command injection in Docker Compose command fields](https://junglewise.ai/threats/cve-2026-42204-coolify-os-command-injection-in-docker-compose-command-fields) (high, CVSS 8.8, published 6 Jul 2026) ## Most severe Coollabs vulnerabilities - [CVE-2026-34048: Coolify improper authorization in terminal websocket routes](https://junglewise.ai/threats/cve-2026-34048-coolify-improper-authorization-in-terminal-websocket-routes) (critical, CVSS 9.9, published 7 Jul 2026) - [CVE-2026-34047: Coolify incorrect authorization in terminal WebSocket routes](https://junglewise.ai/threats/cve-2026-34047-coolify-incorrect-authorization-in-terminal-websocket-routes) (critical, CVSS 9.9, published 7 Jul 2026) - [CVE-2026-34037: Coolify cross-tenant resource cloning in ResourceOperations.php](https://junglewise.ai/threats/cve-2026-34037-coolify-cross-tenant-resource-cloning-in-resourceoperations-php) (critical, CVSS 9.9, published 7 Jul 2026) - [CVE-2026-34038: Coollabsio Coolify command injection in application deployment handling](https://junglewise.ai/threats/cve-2026-34038-coollabsio-coolify-command-injection-in-application-deployment) (critical, CVSS 9.9, published 6 Jul 2026) - [CVE-2026-57498: Coolify authorization bypass in Livewire UI components](https://junglewise.ai/threats/cve-2026-57498-coolify-authorization-bypass-in-livewire-ui-components) (critical, CVSS 9.6, published 29 Jun 2026) - [CVE-2025-34157: Coollabs Coolify stored XSS in project creation workflow](https://junglewise.ai/threats/cve-2025-34157-coollabs-coolify-stored-xss-in-project-creation-workflow) (critical, CVSS 9, published 27 Aug 2025) - [CVE-2025-34161: coollabsio Coolify remote code execution in Git Repository field](https://junglewise.ai/threats/cve-2025-34161-coollabsio-coolify-remote-code-execution-in-git-repository-field) (high, CVSS 8.8, published 27 Aug 2025) - [CVE-2025-66211: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version…](https://junglewise.ai/threats/cve-2025-66211-coolify-is-an-open-source-and-self-hostable-tool-for-managing) (high, CVSS 8.8, published 23 Dec 2025) - [CVE-2025-34159: Coolabs Coolify remote code execution via Docker Compose injection](https://junglewise.ai/threats/cve-2025-34159-coolabs-coolify-remote-code-execution-via-docker-compose) (high, CVSS 8.8, published 27 Aug 2025) - [CVE-2026-59734: Coollabs Coolify OS command injection in health check configuration](https://junglewise.ai/threats/cve-2026-59734-coollabs-coolify-os-command-injection-in-health-check) (high, CVSS 8.8, published 9 Jul 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Coollabs technologies - [Coollabs Coolify](https://junglewise.ai/threats/technologies/coolify): 54 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Coollabs vulnerabilities", https://junglewise.ai/threats/vendors/coollabs, 11 November 2026.