CVE-2026-34170: Coolify SSRF Vulnerability

CVE-2026-34170 Overview

CVE-2026-34170 is a Server-Side Request Forgery (SSRF) vulnerability in Coolify, an open-source self-hostable platform for managing servers, applications, and databases. The flaw exists in versions prior to 4.0.0-beta.471. The GithubAppapi_url field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking. An authenticated user can configure a GitHub App source that causes Coolify to send requests to internal services or cloud metadata endpoints. The issue is tracked under [CWE-918] and is fixed in version 4.0.0-beta.471.

Critical Impact
Authenticated attackers can pivot Coolify into internal networks and reach cloud instance metadata services, potentially exposing sensitive configuration or credentials.

Affected Products

Coolify versions prior to 4.0.0-beta.471
Self-hosted Coolify instances exposing the GitHub App configuration to authenticated users
Deployments running on cloud providers with reachable Instance Metadata Services (IMDS)

Discovery Timeline

2026-07-07 - CVE-2026-34170 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-34170

Vulnerability Analysis

Coolify integrates with GitHub through its GitHub App configuration. Administrators can supply an api_url value used as the base URL for outbound HTTP requests to GitHub's API. Prior to 4.0.0-beta.471, Coolify accepted this value without validation against an allowlist and without blocking private or link-local IP ranges.

An authenticated user with permission to create or edit a GitHub App source can point api_url to arbitrary internal endpoints. The Coolify server then issues HTTP requests to those destinations on behalf of the attacker. Targets include internal management interfaces, container orchestration APIs, and cloud metadata services such as http://169.254.169.254/.

The attack requires authentication and does not modify integrity or availability, but it discloses content from internal services that the Coolify server can reach.

Root Cause

The root cause is missing input validation on a user-controlled URL used to drive server-side HTTP requests. Coolify treated the api_url as trusted configuration data rather than untrusted input. No destination allowlisting, DNS resolution checks, or private IP filtering was applied before dispatching requests.

Attack Vector

An authenticated user submits a GitHub App configuration with api_url set to an internal or metadata URL. Coolify then invokes its GitHub API client using that base URL. Responses returned by the internal target flow back through Coolify to the attacker via the application's normal GitHub integration workflows. See the GitHub Security Advisory for further technical detail.

Detection Methods for CVE-2026-34170

Indicators of Compromise

Outbound HTTP requests originating from the Coolify server to 169.254.169.254, metadata.google.internal, or other cloud metadata hostnames
Requests from Coolify to RFC1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback (127.0.0.0/8) that do not match legitimate internal service integrations
GitHub App source records containing non-GitHub hostnames or IP literals in the api_url field

Detection Strategies

Audit the Coolify database for GitHub App entries where api_url deviates from https://api.github.com or a known GitHub Enterprise host
Inspect application and reverse-proxy logs for GitHub App configuration changes made by non-administrator accounts
Monitor host-level network telemetry from the Coolify server for connections to internal or metadata endpoints

Monitoring Recommendations

Enable egress logging on the Coolify host and alert on connections to instance metadata IPs
Correlate authentication events with GitHub App create or update actions to identify unusual configuration activity
Ingest Coolify audit logs into a centralized SIEM or data lake to retain evidence of api_url modifications

How to Mitigate CVE-2026-34170

Immediate Actions Required

Upgrade Coolify to version 4.0.0-beta.471 or later
Review existing GitHub App source records and remove any with unexpected api_url values
Rotate any cloud credentials that may have been exposed through instance metadata access
Restrict administrative access to the Coolify GitHub App configuration to trusted operators only

Patch Information

The vulnerability is fixed in Coolify 4.0.0-beta.471. Upgrade instructions and the full advisory are available in the Coolify GitHub Security Advisory GHSA-3g6r-cxv5-3c7h.

Workarounds

Block outbound requests from the Coolify host to 169.254.169.254 and other metadata endpoints using host firewall rules
On AWS, enforce IMDSv2 with hop limit 1 to prevent server-side proxying to metadata
Place Coolify behind an egress proxy that allowlists only api.github.com and required GitHub Enterprise hostnames
Limit user roles so only trusted administrators can create or modify GitHub App sources

bash

# Example: block metadata access from the Coolify host using iptables
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 169.254.170.2 -j DROP

# AWS: enforce IMDSv2 with restricted hop limit
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled