CVE-2026-27882

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.461

Description The GitLab webhook endpoint uses a non-constant-time string comparison operator (!==) to validate the webhook secret token. This implementation allows for timing attacks, where an attacker can gradually discover the secret token by measuring differences in response times. A timing attack is a side-channel attack where the attacker attempts to compromise a system by analyzing the time it takes to execute specific algorithms.

Recommendations Update to version 4.0.0-beta.461.