CVE-2026-34198

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.471

Description The TrustProxies middleware trusts all proxies by setting $proxies = '*', which allows the acceptance of X-Forwarded-Host from any source. Additionally, the TrustHosts middleware, designed to prevent host header attacks, contains a circular caching dependency that prevents host validation. During a password reset request, the ResetPassword notification uses the url(route(..., false)) function to generate a reset URL, deriving the host from the request. An unauthenticated attacker can exploit this to trigger a password reset email containing a link to a domain they control, potentially leading to token theft and account takeover.

Recommendations Update to version 4.0.0-beta.471.