CVE-2026-34592

Coolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and Infrastructure

CVSS 7.7 HIGHEPSS 0.2%CWE-639

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.7EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

29 Jun 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, Coolify server and project lookups are not scoped to the current team, allowing any authenticated user to access servers and projects belonging to other teams by specifying their IDs directly. This vulnerability is fixed in 4.0.0-beta.471.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected products

coollabsio · coolify

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/coollabsio/coolify/security/advisories/GHSA-qfcc-2fm3-9q42