CVE-2026-34592: Coolify Authentication Bypass Vulnerability

CVE-2026-34592 Overview

CVE-2026-34592 is an authorization flaw in Coolify, an open-source self-hostable platform for managing servers, applications, and databases. Versions prior to 4.0.0-beta.471 fail to scope server and project lookups to the requesting user's team. Any authenticated user can access resources belonging to other teams by supplying the target resource ID directly. The issue is classified as an Insecure Direct Object Reference [CWE-639] and is fixed in 4.0.0-beta.471.

Critical Impact
Authenticated users on a multi-tenant Coolify instance can read servers and projects owned by other teams, exposing infrastructure configuration and application metadata across tenant boundaries.

Affected Products

Coolify versions prior to 4.0.0-beta.471
Self-hosted Coolify deployments serving multiple teams
Coolify instances with more than one authenticated user account

Discovery Timeline

2026-06-29 - CVE-2026-34592 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-34592

Vulnerability Analysis

Coolify implements team-based multi-tenancy to isolate servers, projects, and application configurations between customer or department boundaries. The vulnerability stems from server and project lookup routes that query records by identifier without applying a team ownership filter. An authenticated user requesting a resource ID that belongs to another team receives the record instead of an authorization error.

The flaw exposes infrastructure metadata that Coolify administrators reasonably expect to be private per team. This includes server hostnames, connection details, project structures, and associated resource identifiers. Cross-team visibility violates the tenancy model that many self-hosted Coolify operators rely on when providing the platform to multiple internal teams or clients.

Root Cause

The underlying defect is missing authorization on object retrieval. Backend controllers accept a resource identifier from the authenticated caller and load the matching row from the database using only that identifier. The controllers do not verify that the loaded object's team_id matches the caller's active team, which is the standard pattern for preventing [CWE-639] Authorization Bypass Through User-Controlled Key.

Attack Vector

Exploitation requires only a valid Coolify account on the target instance. An attacker enumerates or guesses numeric server and project identifiers and issues authenticated requests to the affected endpoints. Because the request originates from a legitimate session, no elevated privileges, user interaction, or lateral movement is required. The scope is changed since the vulnerable component leaks data outside the security boundary of the caller's team.

The vulnerability does not require code execution or file access. It manifests through normal HTTP interactions with the Coolify web application and API surface. Refer to the GitHub Security Advisory GHSA-qfcc-2fm3-9q42 for advisory details.

Detection Methods for CVE-2026-34592

Indicators of Compromise

Authenticated Coolify API or web requests referencing server or project IDs that do not appear in the calling user's team assignments.
Rapid sequential requests against server and project detail endpoints from a single session, consistent with ID enumeration.
Application logs showing successful 200 OK responses to resource lookups made by users who are not members of the resource-owning team.

Detection Strategies

Correlate Coolify application logs with team membership records to flag any resource access where the caller's team does not own the requested object.
Baseline normal per-user access patterns and alert on users who query an unusually broad range of server or project identifiers.
Review reverse proxy or web server access logs for enumeration patterns against Coolify API routes that expose server and project data.

Monitoring Recommendations

Enable verbose request logging on the Coolify instance and forward logs to a centralized SIEM for retention and query.
Track version metadata of deployed Coolify instances and alert when any instance reports a build older than 4.0.0-beta.471.
Monitor authentication events for the creation of new low-privilege accounts on multi-tenant Coolify servers, since account creation is the only precondition for exploitation.

How to Mitigate CVE-2026-34592

Immediate Actions Required

Upgrade all Coolify instances to version 4.0.0-beta.471 or later without delay.
Audit the Coolify user list and remove any accounts that are inactive, unknown, or no longer required.
Review server and project access logs from before the upgrade to identify any cross-team access that may have occurred.

Patch Information

The maintainers fixed CVE-2026-34592 in Coolify 4.0.0-beta.471 by scoping server and project lookups to the caller's current team. Deployments should pull the updated container image or release artifact and restart the Coolify services. Details are documented in the Coolify security advisory GHSA-qfcc-2fm3-9q42.

Workarounds

If immediate patching is not possible, restrict Coolify account creation to a single trusted team until the upgrade can be applied.
Place the Coolify web interface behind a reverse proxy that enforces additional authentication for sensitive routes.
Temporarily consolidate multi-team deployments into separate Coolify instances so that authenticated users cannot reach other tenants' resources.

bash

# Upgrade a self-hosted Coolify deployment to the patched release
cd /data/coolify/source
git fetch --tags
git checkout v4.0.0-beta.471
docker compose pull
docker compose up -d

# Verify the running version
docker exec coolify sh -c 'cat /var/www/html/config/version.php'