coollabsio coolify up to 4.0.0-beta.460 GitLab Webhook Endpoint timing discrepancy

Summaryinfo

A vulnerability classified as problematic has been found in coollabsio coolify up to 4.0.0-beta.460. Affected is an unknown function of the component GitLab Webhook Endpoint. Performing a manipulation results in timing discrepancy. This vulnerability is known as CVE-2026-27882. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in coollabsio coolify up to 4.0.0-beta.460. This affects some unknown processing of the component GitLab Webhook Endpoint. The manipulation with an unknown input leads to a timing discrepancy vulnerability. CWE is classifying the issue as CWE-208. Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. This is going to have an impact on confidentiality. The summary by CVE is:

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.461, the GitLab webhook endpoint uses a non-constant-time string comparison operator (!==) to validate the webhook secret token. This implementation is vulnerable to timing attacks, which could allow an attacker to gradually discover the secret token by measuring response time differences. This vulnerability is fixed in 4.0.0-beta.461.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-27882 since 02/24/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 4.0.0-beta.461 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• coollabsio

Name

• coolify

Version

• 4.0.0-beta.460

Website

• Product: https://github.com/coollabsio/coolify/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion