CVE-2026-121587: Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints

Published Nov 3, 2026

Updated

Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams via manual GitHub, GitLab, Bitbucket and Gitea webhooks. Attackers can send a repository name of % or empty with a common branch like main, exploiting unescaped LIKE wildcards to receive every matching application name before signature verification.

Event History

Nov 3, 2026

CVE Published

via MITRE·04:26 PM

Data Sourced

via MITRE·04:26 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments need remediation?

Coolify deployments running versions before 4.1.1 are affected. The referenced fix is present in version 4.1.1.

What does an attacker need to send to trigger the disclosure?

No authentication is required. An attacker can target manual GitHub, GitLab, Bitbucket, or Gitea webhook endpoints with a repository name of % or an empty value and a common branch such as main.

What information can be exposed?

The issue can reveal matching application names across all teams. The provided impact assessment identifies confidentiality impact only, with no integrity or availability impact.

CVE-2026-121587: Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints

Event History

Frequently Asked Questions

Which deployments need remediation?

What does an attacker need to send to trigger the disclosure?

What information can be exposed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments need remediation?

What does an attacker need to send to trigger the disclosure?

What information can be exposed?