Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck

CVE-2026-121587Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints

Medium 5.3

In plain English

A medium-severity information exposure in coolify from coollabsio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 80.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams via manual GitHub, GitLab, Bitbucket and Gitea webhooks. Attackers can send a repository name of % or empty with a common branch like main, exploiting unescaped LIKE wildcards to receive every matching application name before signature verification.

Affected products (as reported)

Vendor	Product	Versions
coollabsio	coolify	0 – before 4.1.1

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/coollabsio/coolify/pull/10361 issue-tracking, patch
https://github.com/coollabsio/coolify/commit/c1518ba1c0be36da42b6cef06df4b042f5733b01 patch
https://github.com/coollabsio/coolify/commit/809d9b21fa9609de2ce9b49bb838c079598da876 patch
coolify v4.1.1 Release Notes release-notes
https://github.com/coollabsio/coolify/blob/v4.1.0/app/Http/Controllers/Webhook/Github.php#L69 technical-description
https://github.com/coollabsio/coolify product
VulnCheck Advisory: Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints third-party-advisory