CVE-2026-57498: Coolify Auth Bypass Vulnerability

CVE-2026-57498 Overview

Coolify is an open-source, self-hostable platform for managing servers, applications, and databases. CVE-2026-57498 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] affecting Coolify versions prior to 4.0.0-beta.474. While Coolify's API controllers correctly enforce team ownership using Server::whereTeamId($teamId), multiple Livewire web UI components accept server_id and destination_uuid values directly from URL query parameters without validating team ownership. An authenticated attacker on one team can deploy or manipulate resources belonging to other teams. The vulnerability is fixed in Coolify 4.0.0-beta.474.

Critical Impact
Authenticated users can deploy resources onto servers owned by other tenants, breaking multi-tenant isolation and enabling cross-team compromise of confidentiality and integrity.

Affected Products

Coolify versions prior to 4.0.0-beta.474
Self-hosted Coolify deployments serving multiple teams
Coolify Livewire web UI components accepting server_id and destination_uuid parameters

Discovery Timeline

2026-06-29 - CVE-2026-57498 published to the National Vulnerability Database (NVD)
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-57498

Vulnerability Analysis

Coolify enforces multi-tenant isolation by scoping server queries to the caller's team identifier. The API controller layer applies Server::whereTeamId($teamId) before performing any privileged operation. This pattern ensures a user can only act on servers that belong to their team.

The Livewire web UI layer does not apply the same check. Multiple Livewire components read server_id and destination_uuid values from URL query parameters and use them directly in resource operations. No corresponding team ownership lookup is performed against the authenticated session.

An attacker with a valid, low-privileged account on any team can substitute another team's server or destination identifier. The component honors the request and deploys or configures resources against the referenced target. This produces cross-team resource deployment and integrity impact on tenants who never authorized the action.

Root Cause

The root cause is inconsistent authorization enforcement between two code paths. API controllers validate ownership; Livewire components trust identifiers supplied by the client. This is a classic IDOR pattern classified under [CWE-639], Authorization Bypass Through User-Controlled Key.

Attack Vector

Exploitation requires network access to the Coolify instance and low-privileged authenticated access to any team on the platform. The attacker enumerates or guesses UUIDs for servers and destinations belonging to other teams, then submits crafted URLs targeting the vulnerable Livewire components. The scope change reflects that a user authorized within one security context can affect resources in a separate tenant context.

No verified public exploit code is available. Technical details are described in the GitHub Security Advisory.

Detection Methods for CVE-2026-57498

Indicators of Compromise

Unexpected deployments or resource creations on servers owned by teams that did not initiate them
Livewire HTTP requests containing server_id or destination_uuid parameters referencing UUIDs outside the requesting user's team
Coolify audit records showing resource operations authored by users lacking membership in the target team

Detection Strategies

Correlate Coolify application logs against team membership records to flag Livewire actions where the acting user's team does not match the target server's owning team
Inspect reverse proxy or web server access logs for Livewire endpoints receiving server_id and destination_uuid query parameters and cross-reference against expected tenant scope
Alert on newly created applications, databases, or deployments whose owning team differs from the initiating user's session team

Monitoring Recommendations

Enable verbose logging on the Coolify Livewire routes and forward records to a centralized log platform
Monitor for enumeration patterns such as sequential or high-volume requests referencing multiple destination_uuid values from a single account
Track privilege escalation indicators including resource ownership changes and unexpected connections between team boundaries

How to Mitigate CVE-2026-57498

Immediate Actions Required

Upgrade Coolify to version 4.0.0-beta.474 or later on all self-hosted instances
Audit existing servers, destinations, and deployments for resources created by users outside the owning team
Rotate any secrets, deployment keys, and API tokens tied to servers that may have received unauthorized deployments
Restrict network access to the Coolify management UI to trusted administrators while patching

Patch Information

The vulnerability is fixed in Coolify 4.0.0-beta.474. The fix aligns Livewire component authorization with the API controller pattern by validating that server_id and destination_uuid parameters resolve to resources owned by the authenticated user's team. See the GitHub Security Advisory GHSA-725v-f5gh-22q9 for release details.

Workarounds

Operate the Coolify instance as a single-team deployment until the patch is applied, eliminating the cross-tenant attack surface
Place the Coolify UI behind an authenticating reverse proxy that restricts access to a small set of trusted operators
Review team membership and remove untrusted or unnecessary user accounts to reduce the number of principals capable of exploiting the flaw

bash

# Upgrade Coolify to the patched release
curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash

# Verify the running version is 4.0.0-beta.474 or later
docker inspect coolify --format '{{ .Config.Image }}'