Information Disclosure Vulnerability in Coolify by Cool Labs

CVE-2026-121587

What is CVE-2026-121587?

Coolify, prior to version 4.1.1, is susceptible to an information disclosure vulnerability that enables unauthenticated attackers to enumerate application names across all teams. By leveraging manual webhooks from GitHub, GitLab, Bitbucket, and Gitea, attackers can exploit this weakness by submitting a repository name that is either empty or contains a '%' character combined with a common branch name, such as 'main'. This results from unescaped LIKE wildcards, allowing attackers to potentially retrieve all matching application names before signature verification occurs.

References