#Coolify
All CosmicBytez Labs articles tagged #Coolify, across news, security advisories, how-to guides, and projects.
- Security
Coolify GitHub App Setup Handler Auth Bypass (CVE-2026-100746)
A missing-auth flaw in Coolify's GitHub App redirect handler lets remote attackers manipulate the state parameter to bypass auth.
- Security
Coolify CVE-2026-34037: CVSS 9.9 IDOR Enables Cross-Team Resource Takeover
A critical IDOR vulnerability in Coolify's cloneTo() Livewire action allows authenticated users to clone and take over resources across team boundaries...
- Security
Coolify CVE-2026-34047: Terminal WebSocket Authorization Bypass (CVSS 9.9)
A critical authorization bypass in Coolify's terminal WebSocket bootstrap routes allows authenticated users to access server terminals for resources...
- Security
Coolify CVE-2026-34048: Low-Privilege Terminal Escalation via WebSocket (CVSS 9.9)
A critical privilege escalation flaw in Coolify's terminal WebSocket routes lets any low-privileged team member connect to privileged server terminals by...
- Security
CVE-2026-34038: Critical Coolify RCE via Authenticated Command Injection (CVSS 9.9)
A critical command injection vulnerability in Coolify's deployment pipeline allows any authenticated user with write access to execute arbitrary OS...