CVE-2026-41896: Coolify Authentication Bypass Vulnerability

CVE-2026-41896 Overview

CVE-2026-41896 is an authentication bypass vulnerability in Coolify, an open-source self-hostable platform for managing servers, applications, and databases. The flaw affects versions prior to 4.0.0-beta.474. The manual_webhook_secret_github field, which stores the HMAC key used to validate incoming GitHub webhook requests, is nullable and has no default value. Newly created applications therefore start with a null webhook secret. An unauthenticated network attacker can forge a valid X-Hub-Signature-256 header and trigger unauthorized deployments against affected instances.

Critical Impact
Unauthenticated attackers can forge webhook signatures and trigger arbitrary deployments on newly created Coolify applications, compromising integrity of managed services.

Affected Products

Coolify versions prior to 4.0.0-beta.474
Self-hosted Coolify instances with GitHub webhook integrations
Applications created without an explicitly configured manual_webhook_secret_github

Discovery Timeline

2026-06-29 - CVE-2026-41896 published to the National Vulnerability Database (NVD)
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-41896

Vulnerability Analysis

The vulnerability is an authentication bypass classified under [CWE-287] (Improper Authentication). Coolify validates inbound GitHub webhook calls by recomputing an HMAC-SHA256 of the request body using a stored secret. The stored secret field manual_webhook_secret_github is nullable with no default value. When Coolify creates a new application, this field remains null until an operator manually sets it.

PHP's hash_hmac() function silently coerces a null key to an empty string. When the secret is null, the server effectively computes hash_hmac('sha256', $payload, ''). This output is deterministic and reproducible by anyone who knows the payload. An attacker can compute the same value locally and submit it in the X-Hub-Signature-256 header. The server accepts the forged signature as valid.

Root Cause

The root cause is a combination of an insecure schema default and permissive language behavior. The database schema permits manual_webhook_secret_github to be null with no default value, so applications ship with no secret configured. PHP's hash_hmac() does not raise an error or return false for a null key in the affected code path. Instead it coerces the key to '', producing a predictable digest that undermines the signature check.

Attack Vector

The attack requires no authentication, no user interaction, and only network access to the Coolify webhook endpoint. An attacker enumerates or discovers an application identifier tied to a newly created Coolify application. The attacker crafts a webhook payload matching the GitHub push event format expected by Coolify. The attacker computes hash_hmac('sha256', payload, '') locally, sets the X-Hub-Signature-256: sha256=<digest> header, and posts the request to the target endpoint. Coolify validates the signature against the null secret, accepts the request, and triggers a deployment.

No verified exploit code is publicly available. See the GitHub Security Advisory GHSA-w8wm-r924-f65v for authoritative technical details.

Detection Methods for CVE-2026-41896

Indicators of Compromise

Unexpected deployment events in Coolify application logs that do not correlate with legitimate GitHub push activity
Inbound HTTP POST requests to Coolify webhook endpoints from source IP addresses outside GitHub's documented ranges
Applications where manual_webhook_secret_github is null in the Coolify database
Deployment records referencing commits or branches that do not exist in the linked repository

Detection Strategies

Query the Coolify database for applications where manual_webhook_secret_github IS NULL and correlate with recent deployment activity
Compare source IP addresses on incoming webhook requests against the published GitHub webhook IP ranges
Alert on deployment triggers that lack a corresponding GitHub delivery ID in application logs
Review reverse proxy or web server access logs for anomalous POST volume against /webhooks/source/github/* paths

Monitoring Recommendations

Enable verbose logging on the Coolify webhook handler and forward events to a centralized log platform
Monitor for spikes in failed and successful webhook deliveries per application over short time windows
Track configuration changes to manual_webhook_secret_github across all applications and alert on null values
Establish a baseline of expected deployment frequency per application and alert on statistical deviations

How to Mitigate CVE-2026-41896

Immediate Actions Required

Upgrade Coolify to version 4.0.0-beta.474 or later without delay
Audit every application for a null or empty manual_webhook_secret_github value and set a strong random secret
Rotate any GitHub webhook secrets previously configured on affected applications
Review deployment history since application creation for unauthorized triggers and roll back suspicious deployments

Patch Information

The vulnerability is fixed in Coolify 4.0.0-beta.474. The maintainers published details in the Coolify GitHub Security Advisory GHSA-w8wm-r924-f65v. Operators of self-hosted instances must apply the upgrade because Coolify is deployed on user-managed infrastructure.

Workarounds

Configure a strong random manual_webhook_secret_github value on every application before exposing webhook endpoints
Restrict access to Coolify webhook endpoints at the reverse proxy or firewall level to known GitHub source IP ranges
Disable manual GitHub webhook integrations on applications that do not require them until the patch is applied
Place the Coolify webhook endpoint behind an authenticating proxy or VPN if upgrade cannot be performed immediately

bash

# Reverse proxy example restricting webhook path to GitHub IP ranges (nginx)
location /webhooks/source/github/ {
    allow 192.30.252.0/22;
    allow 185.199.108.0/22;
    allow 140.82.112.0/20;
    allow 143.55.64.0/20;
    deny all;
    proxy_pass http://coolify_backend;
}