CVE-2026-100746

Executive Summary

CVE-2026-100746 is a missing authentication vulnerability in coollabsio Coolify, a self-hosted platform-as-a-service and deployment management tool. The flaw resides in the GitHub App Setup Handler, specifically the Github::redirect function accessible via the /webhooks/source/github/redirect endpoint, where manipulation of the state argument allows an attacker to bypass authentication checks. Successful exploitation permits unauthorized access to the GitHub App setup flow, potentially allowing attackers to link their own GitHub App to a victim's Coolify instance, leading to unauthorized resource deployment, data exposure, and lateral movement within the affected environment. Although the CVSS score is 7.3 (High), the EPSS score is not yet available, and there is no evidence of exploitation in the wild at this time; however, a public exploit exists, and the vulnerability remains unpatched in the absence of the specified commit.

Technical Analysis

CVE-2026-100746 affects Coolify versions up to 4.1.0. The vulnerability is classified as CWE-287: Improper Authentication, and it resides within the GitHub App Setup Handler component. According to the NVD description, the affected function is Github::redirect, which is reachable through the URL path /webhooks/source/github/redirect. The core issue is the manipulation of the state argument, which results in missing authentication. The state parameter is typically used in OAuth and GitHub App installation flows to prevent cross-site request forgery (CSRF) and to associate the callback with the initiating user session. In this case, by manipulating the state argument, an attacker can bypass the authentication mechanism that is supposed to verify that the request originates from an authenticated Coolify administrator.

The attack surface is the publicly accessible webhook endpoint. Since the endpoint is part of the GitHub App setup handler, it is likely exposed to the internet to receive callbacks from GitHub. The missing authentication means that an unauthenticated remote attacker can invoke this function. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates that the attack is network-based, requires no privileges or user interaction, and has a low impact on confidentiality, integrity, and availability. The low impact subscores reflect that the vulnerability primarily allows unauthorized actions within the setup flow, rather than direct system compromise, but it can still lead to significant consequences such as unauthorized GitHub App integration, which could be used to deploy malicious code or access sensitive deployment configurations.

The patch commit fc89e357feed5180ed1ab5eb9cb330578f025539 presumably adds proper authentication checks or validates the state parameter to ensure it is tied to an authenticated session. However, no official advisory or patch details have been released by the vendor, and the patch confidence is 0/4, indicating that the fix is not yet available through standard channels. The vulnerability is unpatched in all versions up to 4.1.0, and the only known mitigation is to upgrade to version 4.1.1, though the availability of that version is not confirmed by the data provided.

Exploitation Scenarios

1. Reconnaissance/target identification: An attacker scans the internet for Coolify instances by looking for the characteristic login page or the /webhooks/source/github/redirect endpoint. Shodan dorks such as http.title:"Coolify" or http.html:"Coolify" can identify exposed instances. The attacker then verifies the version, either through the login page or by probing the endpoint for version-specific behavior.

2. Triggering the flaw: The attacker sends a crafted HTTP request to the vulnerable endpoint /webhooks/source/github/redirect, manipulating the state parameter. The exact manipulation is not detailed in the NVD description, but it likely involves setting state to a value that bypasses the authentication check, such as omitting it, using a predictable value, or injecting a value that the application accepts without validation. Because the vulnerability is a missing authentication issue, the attacker does not need to be authenticated to the Coolify instance.

3. Payload/execution method: The attacker's goal is to complete the GitHub App setup flow without proper authorization. By manipulating state, the attacker can cause the Coolify instance to accept a GitHub App installation or callback that is not associated with an authenticated administrator. This could allow the attacker to link their own GitHub App to the victim's Coolify instance, effectively granting them control over deployments. The public exploit likely automates this process, requiring only the target URL and a malicious GitHub App configuration.

4. Post-exploitation impact: Once the attacker's GitHub App is linked, they can potentially deploy malicious containers, access environment variables and secrets stored in Coolify, or use the instance as a pivot point to attack other systems. The low integrity impact (I:L) suggests that the attacker can modify some data but not necessarily all; however, in the context of a deployment platform, even limited modification can lead to significant downstream effects, such as deploying backdoored applications.

No public PoC is available in the provided data, but the report states "The exploit has been made public and could be used." Therefore, the attack chain is inferred from the vulnerability class and the limited details. It is crucial to note that the absence of specific technical details means that the exact exploitation steps may vary, but the mechanism—bypassing authentication via the state parameter—is clear.

Impact Assessment

The business impact of CVE-2026-100746 is significant for organizations using Coolify to manage their deployments. Coolify is often used to deploy and manage applications, databases, and services. An attacker who successfully exploits this vulnerability can gain unauthorized access to the GitHub App setup flow, potentially leading to the compromise of the entire deployment pipeline. This could result in:

• Unauthorized deployment of malicious code or containers.
• Exposure of sensitive environment variables, API keys, and secrets.
• Lateral movement to connected systems, such as cloud providers or internal networks.
• Reputational damage and loss of customer trust.

The CVSS score of 7.3 (High) reflects the network attack vector, low attack complexity, no privileges required, and no user interaction. The impact subscores are low (C:L/I:L/A:L), indicating that the vulnerability alone does not grant full control but can be a stepping stone for further attacks. The blast radius includes all Coolify instances version 4.1.0 and below that are exposed to the internet. Given that Coolify is self-hosted, the number of affected instances is unknown, but it is likely used by many small to medium-sized organizations and individual developers. The lack of an EPSS score means that the probability of exploitation is not yet quantified, but the public exploit increases the risk. There is no evidence of active exploitation in the wild, and the vulnerability is not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: Coolify GitHub App Setup Authentication Bypass (CVE-2026-100746)
id: 3f9a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects manipulation of the state parameter in the Coolify GitHub App setup handler that may indicate an authentication bypass attempt.
author: Valters IT Threat Intel
date: 2026-05-12
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-100746
logsource:
    category: webserver
    product: coolify
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/webhooks/source/github/redirect'
        cs-uri-query|contains: 'state='
    filter_legit:
        cs-uri-query|re: 'state=[a-f0-9]{32,}'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate GitHub App setup with valid state tokens.
level: high

YARA Rule

rule CVE_2026_100746_Coolify_Auth_Bypass
{
    meta:
        description = "Detects Coolify instances potentially vulnerable to CVE-2026-100746"
        author = "Valters IT Threat Intel"
        date = "2026-05-12"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100746"
        cve = "CVE-2026-100746"
    strings:
        $endpoint = "/webhooks/source/github/redirect"
        $func = "Github::redirect"
        $version = /version\s*[=:]\s*['\"]?4\.1\.[0-9]/ nocase
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100746 Coolify GitHub App Setup Auth Bypass Attempt"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/webhooks/source/github/redirect"; http.uri; content:"state="; nocase; reference:cve,2026-100746; classtype:attempted-admin; sid:10000001; rev:1;)

Elastic Detection

sequence by host.id, user.id with maxspan=5s
  [ network where network.protocol == "http" and
      http.request.method == "GET" and
      url.path == "/webhooks/source/github/redirect" and
      url.query contains "state=" ]

Splunk SPL Query

index=web sourcetype=access_combined
| search method=GET uri_path="/webhooks/source/github/redirect" uri_query="*state=*"
| regex uri_query="state=(?!([a-f0-9]{32,}))"
| stats count by src_ip, uri_query, status
| where count > 5

Wazuh OSSEC Rule

<group name="coolify,web,">
  <rule id="100200" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">/webhooks/source/github/redirect</field>
    <field name="url">state=</field>
    <description>CVE-2026-100746: Coolify GitHub App setup authentication bypass attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

1. Immediate mitigations:

   • Isolate the Coolify instance from the internet if not strictly required, or restrict access to the /webhooks/source/github/redirect endpoint to trusted IP addresses (e.g., GitHub's IP ranges).
   • Implement a web application firewall (WAF) rule to block requests to the vulnerable endpoint with manipulated state parameters. Use the Suricata rule provided as a template for network-level blocking.
   • Monitor logs for suspicious requests to the endpoint, as described in the detection section, and investigate any anomalies.
   • Disable the GitHub App integration temporarily if it is not essential.

2. Patch/upgrade steps:

   • Upgrade Coolify to version 4.1.1 or later, which contains the fix identified by commit fc89e357feed5180ed1ab5eb9cb330578f025539. However, patch confidence is 0/4, meaning the fix may not be officially released or verified. Confirm the availability of version 4.1.1 from the official source before upgrading.
   • If version 4.1.1 is not available, consider applying the patch manually by cherry-picking the commit from the Coolify repository, if possible, and testing thoroughly in a staging environment.

3. Long-term hardening:

   • Ensure that all authentication and authorization checks are properly implemented for any setup or callback endpoints, especially those exposed to the internet.
   • Use CSRF tokens and validate the state parameter to prevent tampering.
   • Regularly update Coolify and all dependencies to the latest versions.
   • Conduct security reviews of custom integrations and webhook handlers.
   • Implement network segmentation to limit the impact of a compromised deployment platform.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100746
• Coolify GitHub Repository: https://github.com/coollabsio/coolify
• Patch Commit: https://github.com/coollabsio/coolify/commit/fc89e357feed5180ed1ab5eb9cb330578f025539
• CWE-287: https://cwe.mitre.org/data/definitions/287.html
• No known threat actor campaigns or exploit-in-the-wild evidence at this time.