CVE-2026-27882: Coolify Timing Attack on GitLab Webhook Token Validation

Technical summary

The GitLab webhook endpoint in Coolify implements token validation using the non-constant-time JavaScript inequality operator (!==) rather than a cryptographic comparison function. This creates a timing side-channel: when comparing the attacker-supplied token against the stored secret, the comparison exits as soon as a mismatched character is found. By sending many webhook requests with different token candidates and measuring response latencies, an attacker can determine which characters are correct and progress toward recovering the full token. The vulnerability is classified under CWE-208 (Observable Timing Discrepancy), a well-known category of side-channel attacks. Remediation requires replacing the vulnerable comparison with constant-time alternatives, which Coolify addressed in beta.461.

Business impact

Compromising a webhook secret grants an attacker the ability to forge GitLab webhook events to Coolify, potentially triggering unauthorized deployments, application updates, or database operations. In multi-tenant or production environments, this could enable lateral movement, data exfiltration, or service disruption. The medium CVSS score reflects the requirement for high attack complexity (the attacker must perform numerous timed requests and statistical analysis), but the confidentiality and integrity impact remains meaningful for organizations relying on webhook-driven automation.

Affected systems

Coolify installations running any version prior to 4.0.0-beta.461 are affected, provided the GitLab webhook integration is enabled or accessible. The vulnerability is specific to Coolify's codebase and does not affect other webhook consumers or GitLab itself. Self-hosted deployments are the primary concern, as they represent the typical Coolify deployment model.

Exploitability

Exploitation requires network access to the Coolify webhook endpoint and the ability to send multiple crafted webhook requests. No authentication is needed to send requests to the endpoint itself—the secret validation is the intended protection. The attacker complexity is rated as high because successful exploitation demands statistical analysis of timing measurements across many requests, accounting for network jitter and other latency sources. Practical exploitation is feasible but requires sophistication; it is not trivial for unskilled adversaries.

Remediation

Upgrade Coolify to version 4.0.0-beta.461 or later, which implements constant-time string comparison for webhook token validation. Organizations unable to upgrade immediately should consider additional network-level controls: restrict webhook endpoint access to known GitLab server IP ranges, monitor for repeated failed webhook validation attempts, and rotate webhook secrets regularly to limit the window for timing-based discovery.

Patch guidance

Update Coolify using the project's standard release and deployment channels. Verify that the deployed version is 4.0.0-beta.461 or a subsequent stable release. If using a package manager or container registry, confirm the digest or version tag reflects the patched build. After upgrade, test webhook functionality with a GitLab repository to ensure continuity of CI/CD automation.

Detection guidance

Monitor webhook endpoint logs for patterns of repeated requests with similar token prefixes, which may indicate timing-based reconnaissance. Watch for failed webhook validation attempts concentrated within short time windows. Network-based detection is challenging due to the reliance on response-time analysis, but anomalously high rates of 401/403 responses on the webhook endpoint combined with consistent source IPs warrant investigation. Consider implementing request rate-limiting on the webhook endpoint to increase attacker complexity.

Why prioritize this

Although the CVSS score is medium and exploitation requires technical sophistication, timing attacks on cryptographic material are well-understood, and the target (webhook secrets) directly governs automation privileges. Organizations with active GitLab integration, particularly those where deployments trigger database or production changes, should prioritize this patch to prevent business logic abuse. The fix is lightweight and available in beta, making mitigation straightforward.

Risk score, explained

The CVSS 4.8 score reflects low attack complexity (network-accessible endpoint, no authentication required) tempered by high attack complexity in practical exploitation (timing analysis, statistical noise). The impact is limited to confidentiality and integrity (token disclosure and potential unauthorized webhook events) with no direct availability impact. The score is appropriate for a specialized side-channel attack with meaningful but not catastrophic business consequences.

Frequently asked questions