CVE-2026-41896 Details
Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the HMAC key is the application's manual_webhook_secret_github field, which is used by Coolify's webhook endpoints to validate incoming requests, is nullable with no default — meaning newly created applications have a null webhook secret. PHP's hash_hmac() function silently coerces a null key to an empty string ''. So when the secret is null, the server computes hash_hmac('sha256', $payload, '') — a deterministic value that any attacker can calculate independently. By sending X-Hub-Signature-256: sha256=<hash_hmac('sha256', payload, '')>, an unauthenticated attacker can forge a valid signature and trigger deployments. This vulnerability is fixed in 4.0.0-beta.474.
A vulnerability in Coolify versions prior to 4.0.0-beta.474 allows unauthenticated deployment triggers through a webhook HMAC bypass. The issue arises because the HMAC key, derived from the 'manual_webhook_secret_github' field, is nullable and defaults to null for new applications. This null value is silently converted to an empty string by PHP's hash_hmac() function, resulting in a predictable HMAC that can be exploited. By sending a crafted X-Hub-Signature-256 header, an attacker can forge a valid signature and initiate deployments, particularly disrupting services by forcing redeployments or exploiting branch-specific deployments.
Users should update to Coolify version 4.0.0-beta.474 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 29, 2026CISA-ADP
Assessed Jun 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/coollabsio/coolify/security/advisories/GHSA-w8wm-r924-f65v | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/coollabsio/coolify/security/advisories/GHSA-w8wm-r924-f65v | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Coolify | <= 4.0.0-beta.473 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 30, 2026 | CVE Modified | CISA-ADP |
| Jun 29, 2026 | New CVE Received | [email protected] |