CVE-2026-42147 Details
Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, S3 storage endpoint validation only checks URL format and testConnection() sends a server-side request to the configured endpoint, allowing an authenticated user with storage management permissions to make Coolify request internal or metadata-service URLs. This issue is fixed in version 4.0.0-beta.474.
A server-side request forgery (SSRF) vulnerability has been identified in Coolify versions prior to 4.0.0-beta.474. The issue arises in the S3 storage functionality, where the endpoint validation is insufficient. Authenticated users with storage management permissions can configure custom S3-compatible endpoint URLs. The 'testConnection()' method then sends a request to the specified endpoint without verifying if the URL points to internal or metadata-service addresses. This flaw allows access to cloud metadata services, internal network services, and error-based information disclosure about internal service responses.
Users can update to Coolify version 4.0.0-beta.474 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 7, 2026CISA-ADP
Assessed Jul 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/coollabsio/coolify/security/advisories/GHSA-pwm4-w33c-wjf3 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/coollabsio/coolify/commit/297e9c41e19958f6237919794c28c3fb1d4cda32 | [email protected] | Source CodeVendor |
| https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.474 | [email protected] | Release NotesVendor |
| https://github.com/coollabsio/coolify/security/advisories/GHSA-pwm4-w33c-wjf3 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Coolify | <= 4.0.0-beta.473 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | New CVE Received | [email protected] |