PT-2026-56139

CVE-2026-42147

Published

2026-07-07

Updated

2026-07-07

Description by

CVSS 3.1

4.9

Medium

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.474

Description An authenticated user with storage management permissions can perform server-side requests to internal or metadata-service URLs. This occurs because the S3 storage endpoint validation only verifies the URL format, and the testConnection() function sends a request to the configured endpoint without sufficient validation.

Recommendations Update to version 4.0.0-beta.474.

Exploitability

Exploit

Fix

Impacts

Researchers

Morimori-Dev

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)

Related identifiers