CVE-2026-100744

Executive Summary

CVE-2026-100744 is a missing authorization vulnerability (CWE-862) in coollabsio Coolify versions up to and including 4.1.2, affecting the route-level middleware component located at app/Http/Middleware/CanUpdateResource.php. The flaw allows a remote, unauthenticated attacker to bypass authorization checks on resource update operations, potentially leading to unauthorized modification of managed resources. The exploit has been publicly published, raising the risk of immediate opportunistic exploitation, and upgrading to version 4.2.0 is required to fully remediate the issue.

Technical Analysis

The vulnerability resides in a middleware class designed to gate whether a resource can be updated—CanUpdateResource.php, located at app/Http/Middleware/CanUpdateResource.php. Middleware in this position is responsible for intercepting HTTP requests before they reach the controller handling resource updates and enforcing an authorization decision. CWE-862 (Missing Authorization) indicates that this enforcement is absent, incomplete, or trivially bypassable for one or more update paths.

The NVD description explicitly notes that the "affected element is an unknown function" within that file, meaning the precise method or condition within the middleware that fails to enforce authorization is not disclosed in the advisory text. It is therefore not possible to state, from the available data alone, exactly which conditional branch or permission check is defective. What is derivable from the description is the vulnerability class and attack surface:

• Class: Missing authorization on a route-level middleware controlling resource update operations.
• Attack surface: HTTP routes that are processed by CanUpdateResource.php, i.e., resource update endpoints exposed by the Coolify application.
• Preconditions: The attack may be launched remotely (AV:N), requires no privileges (PR:N), no user interaction (UI:N), and low attack complexity (AC:L), per the published CVSS vector.
• Impact scope: Per the CVSS vector, confidentiality, integrity, and availability impacts are all rated Low (C:L/I:L/A:L), suggesting the flaw is constrained in what an attacker can read, modify, or disrupt through this specific path rather than granting full system compromise.

Because no function-level detail, request parameter names, or endpoint paths beyond the middleware file are provided, any claim about exact HTTP methods, parameter names, or bypass payloads would be speculative and is deliberately omitted.

Exploitation Scenarios

No public proof-of-concept artifact, Nuclei template, or exploit code is present in the provided data set; however, the NVD description states that an exploit has been published and may be used. The attack chain below is therefore described at the vulnerability-class level and inferred from the nature of missing authorization in route-level middleware.

1. Reconnaissance / Target Identification. An attacker identifies an internet- or network-exposed Coolify instance running version 4.1.2 or earlier. Since the vulnerable component is route-level middleware, the attacker's objective is to enumerate routes that perform resource update operations and are intended to be protected by CanUpdateResource.php.

2. Triggering the Flaw Class. The attacker sends a crafted request directly to a resource-update route, attempting to reach it without satisfying the authorization conditions that the middleware is supposed to enforce. Because the authorization check is missing, the request is not blocked before reaching the underlying update operation. The exact form of the request—HTTP method, parameters, or body structure—is not specified in the available data and is not fabricated here.

3. Payload / Execution Method. At the class level, the "payload" is simply a request that would ordinarily be rejected by a correctly functioning authorization middleware. There is no memory-corruption, injection string, or serialized-object payload required; the vulnerability is logical, relying on the absence of a check rather than the malformation of input.

4. Post-Exploitation Impact. Successful exploitation results in unauthorized update operations on Coolify-managed resources. Given the Low-C/I/A ratings, the practical effect is limited modification of resource state rather than full application takeover, though in a platform-management context even limited unauthorized updates can be materially significant (e.g., altering configuration or deployment-related resource attributes). Note: "No public PoC artifact is present in this data set; the exploit is reported as published by NVD, and the chain above is inferred from the missing-authorization vulnerability class."

Impact Assessment

CVE-2026-100744 carries a CVSS 3.1 base score of 7.3 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The subscores indicate:

• Attack Vector (Network): Exploitation is possible remotely, meaning exposure of a Coolify management interface to an untrusted network materially increases risk.
• Attack Complexity (Low): No special conditions or race windows are required; the missing check is directly reachable.
• Privileges Required (None) / User Interaction (None): An attacker does not need an authenticated session or victim action, which amplifies the practical risk of the missing-authorization condition.
• Scope (Unchanged): Impact is confined to the vulnerable component's security authority.
• Confidentiality / Integrity / Availability (Low each): The impact is bounded—not a full compromise—but still permits unauthorized resource updates, which in a deployment/orchestration platform like Coolify can translate into meaningful integrity and operational risk.

Blast radius: Any Coolify instance at version 4.1.2 or earlier that exposes update-processing routes to an untrusted network. Because Coolify is used to manage deployments and infrastructure resources, unauthorized modifications could affect downstream services under its management. EPSS is not yet scored by FIRST.org, so no probabilistic exploitation estimate is available. CISA KEV status is NO—there is no evidence of known exploitation in CISA's catalog.

Detection Guidance

Sigma Rule

title: Potential Coolify CVE-2026-100744 Missing Authorization Exploitation
id: 8f2c1e4a-3b7d-4c9e-9a1f-0d5e6b7c8a91
status: experimental
description: Detects requests to Coolify resource update routes that reach controllers without the CanUpdateResource middleware authorization decision, indicative of CWE-862 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100744
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: coolify
detection:
  selection_method:
    cs-method:
      - 'PUT'
      - 'PATCH'
      - 'POST'
  selection_path:
    cs-uri-stem|contains:
      - '/update'
  selection_status:
    sc-status: 200
  condition: selection_method and selection_path and selection_status
falsepositives:
  - Legitimate authenticated administrators performing authorized resource updates
level: medium
tags:
  - attack.t1190
  - cwe.862

YARA Rule

rule CVE_2026_100744_Coolify_Missing_Authorization
{
    meta:
        description = "Detects Coolify source files associated with the vulnerable CanUpdateResource middleware"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100744"
        date = "2026-01-01"
        severity = "high"

    strings:
        $file = "CanUpdateResource" ascii wide
        $path = "app/Http/Middleware/CanUpdateResource.php" ascii wide
        $ver = "4.1.2" ascii wide

    condition:
        ($file or $path) and filesize < 512KB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100744 Coolify Missing Authorization Attempt"; flow:established,to_server; http.method; content:"PUT"; http.uri; content:"update"; nocase; classtype:attempted-admin; sid:2026100744; rev:1; reference:cve,2026-100744; metadata:affected_product Coolify, attack_target Web_Server;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method in ("PUT", "PATCH", "POST") and
      url.path contains "update" ]
  [ network where http.response.status_code == 200 and
      url.path contains "update" ]

Splunk SPL Query

index=web sourcetype=coolify:access
| search http_method IN ("PUT","PATCH","POST") uri_path="*update*" status=200
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, http_method
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="coolify,web,">
  <rule id="100744" level="10">
    <decoded_as>json</decoded_as>
    <field name="http_method">PUT|PATCH|POST</field>
    <field name="url">\.*update\.*</field>
    <description>CVE-2026-100744: Possible Coolify missing authorization exploitation via resource update route</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_100744,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source in this data set). Note: the NVD description references a fix in version 4.2.0 via commit 39ae16de4248075de8c08f3259114e064b20d52d, but no independent patch verification is present in the tracked sources for this report; treat remediation as unverified until the 4.2.0 upgrade is confirmed in your environment.

1. Immediate Mitigations

   • Restrict network exposure of the Coolify management interface using firewall rules, private networking, or a reverse proxy with authentication and IP allow-listing. Since the attack vector is network-based and unauthenticated, reducing reachability is the most effective stopgap.
   • Place the Coolify dashboard behind an authenticated access gateway (SSO/reverse proxy) so that update routes are not directly reachable by unauthenticated clients.
   • Monitor access logs for unauthorized PUT/PATCH/POST requests to resource update routes, as reflected in the detection rules above.

2. Patch / Upgrade Steps

   • Upgrade Coolify to version 4.2.0, which the advisory states is sufficient to fix the issue.
   • Verify the deployment reflects the patch commit 39ae16de4248075de8c08f3259114e064b20d52d.
   • After upgrading, re-validate that resource update routes correctly enforce the authorization decision performed by CanUpdateResource.

3. Long-Term Hardening

   • Adopt a deny-by-default authorization posture for all route-level middleware, with automated tests asserting that unauthorized requests to update routes are rejected.
   • Maintain an inventory of management-plane applications and subscribe to vendor release feeds to shorten exposure windows for future missing-authorization flaws.
   • Implement continuous access-log analytics to baseline normal update-route traffic and alert on anomalies from unauthenticated or unusual source addresses.

References

• National Vulnerability Database — CVE-2026-100744: https://nvd.nist.gov/vuln/detail/CVE-2026-100744
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• Coolify project repository (vendor): https://github.com/coollabsio/coolify
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-100744 not currently listed)

No specific threat actor campaigns or confirmed exploit-in-the-wild telemetry are available in the provided data for CVE-2026-100744; NVD states only that a public exploit has been published and may be used.