CVE-2026-27882: Coolify: Timing Attack in GitLab Webhook Token Validation
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.461, the GitLab webhook endpoint uses a non-constant-time string comparison operator (!==) to validate the webhook secret token. This implementation is vulnerable to timing attacks, which could allow an attacker to gradually discover the secret token by measuring response time differences. This vulnerability is fixed in 4.0.0-beta.461.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Coolifyto a version that resolves this vulnerability.Fixed in 4.0.0-beta.461
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27882?
The severity of CVE-2026-27882 is medium with a score of 4.8.
What is CVE-2026-27882?
CVE-2026-27882 is a vulnerability in Coolify that allows for timing attacks in the GitLab webhook token validation due to the use of a non-constant-time string comparison.
How do I fix CVE-2026-27882?
To fix CVE-2026-27882, upgrade Coolify to version 4.0.0-beta.461 or later.
What type of attack does CVE-2026-27882 allow for?
CVE-2026-27882 allows for timing attacks that can potentially expose the webhook secret token.
What software is affected by CVE-2026-27882?
CVE-2026-27882 affects the Coolify software prior to version 4.0.0-beta.461.