CVE-2026-41896

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.474

Description An issue exists where the manual webhook secret github field, used by webhook endpoints to validate incoming requests, is nullable and lacks a default value. For newly created applications, this secret remains null. Because the hash hmac() function in PHP coerces a null key into an empty string, the server generates a deterministic hash that can be independently calculated. An unauthenticated attacker can exploit this by providing a forged signature in the X-Hub-Signature-256 header to trigger unauthorized deployments.

Recommendations Update to version 4.0.0-beta.474.