CVE-2026-121587 in Coolify
Summary
by MITRE • 11/03/2026
Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams via manual GitHub, GitLab, Bitbucket and Gitea webhooks. Attackers can send a repository name of % or empty with a common branch like main, exploiting unescaped LIKE wildcards to receive every matching application name before signature verification.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in Coolify versions prior to 4.1.1 represents a critical information disclosure flaw rooted in improper input validation and the misuse of database query patterns within webhook handling mechanisms. This security issue specifically affects the integration points with external version control systems, including GitHub, GitLab, Bitbucket, and Gitea. The core technical deficiency lies in how the application processes incoming repository names from these webhooks before performing cryptographic signature verification to authenticate the request source. By exploiting unescaped LIKE wildcards within SQL queries or similar string matching operations, an attacker can manipulate the search parameters to bypass intended filtering logic. Specifically, by submitting a repository name containing percent signs (%), which act as wildcard characters in standard SQL syntax, or by sending empty strings combined with common branch names such as main, the application returns every record that matches these broad patterns rather than rejecting them or returning an error for invalid input.
This architectural flaw allows unauthenticated actors to enumerate application names across all teams associated with a Coolify instance without needing valid credentials or signed requests. The sequence of operations is critical to the exploit's success; because the wildcard expansion occurs prior to signature verification, the attacker can harvest sensitive metadata about deployed applications before the system has confirmed that the request originated from a legitimate source. This pre-authentication data leakage provides adversaries with valuable intelligence regarding the target environment, including the structure of deployments and potentially identifying high-value targets for further exploitation attempts. The ability to retrieve all matching application names effectively neutralizes any security through obscurity measures and exposes the internal organization's deployment topology to external observers.
From an operational impact perspective, this vulnerability facilitates reconnaissance activities that can lead to more severe compromises such as unauthorized access or service disruption. Knowledge of specific application names allows attackers to tailor subsequent attacks against known software stacks or configurations associated with those applications. It also aids in mapping out the attack surface by revealing which teams are active and what resources they manage. This level of visibility is particularly dangerous in multi-tenant environments where isolation between teams is expected, as it breaches logical boundaries and exposes cross-team data that should remain confidential. The exploitation does not require complex tooling or high privilege levels, making it accessible to a wide range of threat actors seeking initial footholds within an organization's infrastructure.
To mitigate this vulnerability, organizations running Coolify must upgrade immediately to version 4.1.1 or later, where the underlying query logic has been corrected to properly escape special characters and enforce strict input validation before database execution. In addition to patching, administrators should implement network-level controls such as firewall rules that restrict webhook endpoints to only accept traffic from known IP ranges of supported Git providers like GitHub, GitLab, Bitbucket, and Gitea. This defense-in-depth approach ensures that even if application-layer vulnerabilities exist in the future, they cannot be exploited by untrusted sources on the internet. Furthermore, enabling strict logging and monitoring for anomalous webhook payloads can help detect attempted enumeration attacks in real-time.
This vulnerability aligns with CWE-209, which describes the generation of an error message that reveals sensitive information to unauthorized actors, as well as CWE-78, involving improper neutralization of special elements used in an OS command or query, commonly known as injection flaws. In terms of offensive security frameworks, this behavior corresponds to ATT&CK technique T1046, Network Service Discovery, where adversaries probe for services and data that can be leveraged during later stages of a cyber attack. Addressing these issues requires both immediate patching and long-term architectural reviews to ensure that authentication checks precede resource-intensive or sensitive operations like database queries involving user-supplied input.