CVE-2026-34170: Coolify SSRF in GitHub App Configuration Allows Internal Service Enumeration

Technical summary

CVE-2026-34170 is a server-side request forgery (CWE-918) in Coolify versions prior to 4.0.0-beta.471. The GithubApp configuration endpoint accepts an api_url parameter that is subsequently used as the base URL for HTTP requests made by the Coolify server. The vulnerability stems from the absence of URL validation, allowlisting, or private IP address blocking. An authenticated attacker can supply a malicious api_url pointing to RFC1918 addresses, localhost, or cloud metadata endpoints (e.g., 169.254.169.254 for AWS), enabling reconnaissance of internal infrastructure or extraction of sensitive environment variables and credentials. The fix in 4.0.0-beta.471 addresses this by implementing proper URL validation and blocking private IP ranges.

Business impact

This vulnerability allows internal reconnaissance by users with Coolify access credentials. In multi-tenant or shared Coolify deployments, a compromised or malicious user account can map internal infrastructure, access cloud provider metadata services, or interact with restricted internal applications. While the CVSS score of 4.3 reflects limited scope (no network propagation, no integrity impact), the practical impact depends on what sensitive services and metadata are exposed on the internal network. Organizations running Coolify in cloud environments (AWS, GCP, Azure) face heightened risk because metadata endpoints are a primary attack vector for credential theft and privilege escalation.

Affected systems

All Coolify installations prior to version 4.0.0-beta.471 are affected. The vulnerability requires authentication, so it impacts only deployments where user accounts exist. Self-hosted Coolify instances are the primary targets, as this tool is designed for infrastructure-as-code workflows in private networks. Cloud-hosted or publicly exposed Coolify instances with multiple user accounts carry elevated risk.

Exploitability

Exploitability is low-to-medium. The attack requires valid Coolify credentials, eliminating opportunistic exploitation. However, within organizations running Coolify, the barrier to triggering the vulnerability is trivial—adding a GitHub App source with a crafted api_url requires only normal UI interaction and no special knowledge. No public exploit code is known, but proof-of-concept is straightforward and does not require zero-day research. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) correctly indicates that network access combined with low complexity and authenticated privilege makes this a practical information disclosure risk in operational environments.

Remediation

Upgrade Coolify to version 4.0.0-beta.471 or later. Verify the fix by reviewing release notes to confirm that URL validation and private IP blocking are implemented in the GitHub App configuration handler. Until patching is complete, restrict Coolify user accounts to trusted personnel and audit existing GitHub App configurations to identify any suspicious api_url values. Consider network segmentation to limit the impact of SSRF: ensure Coolify's egress is restricted to GitHub's official API endpoints via firewall rules or outbound proxy controls.

Patch guidance

Upgrade to Coolify 4.0.0-beta.471 or newer. Since Coolify is a rapid-release, beta-versioned project, verify patch availability and test in a non-production environment before deployment. After patching, validate that GitHub App configuration rejects or sanitizes non-standard api_url values. Document the patch date for compliance and audit purposes. If your Coolify installation uses a pinned version or custom build, check upstream release notes at the Coolify GitHub repository to confirm the fix is included in your target version.

Detection guidance

Monitor Coolify's GitHub App configuration logs for api_url entries that deviate from the official GitHub API domain (api.github.com or github.enterprise.com). Look for patterns such as 127.0.0.1, 192.168.*, 10.*, 172.16-31.*, or cloud metadata IP ranges (169.254.169.254, 169.254.170.2, etc.) in configuration audit logs. Check HTTP request logs for outbound connections from the Coolify process to private IP ranges or unusual domains not consistent with GitHub API access. Implement network-level detection by flagging outbound traffic from Coolify servers to RFC1918 addresses or metadata endpoints.

Why prioritize this

Although the CVSS score is MEDIUM (4.3), this vulnerability should be prioritized based on deployment context. If Coolify runs in a cloud environment or on a network with sensitive internal services, the information disclosure risk is elevated. The ease of exploitation (authenticated but trivial to trigger) and the typical use case (infrastructure-as-code, often in sensitive environments) warrant swift patching. Defer below critical patching only if Coolify is isolated, has no cloud metadata exposure, and user accounts are tightly controlled.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-accessible, low-complexity authenticated attack with low confidentiality impact and no integrity or availability impact. The score assumes a single-user scope and no amplification. In practice, organizations should assign a higher internal risk rating if: (1) Coolify is deployed in cloud environments with metadata endpoints; (2) internal network services are sensitive or credential-bearing; (3) user accounts are provisioned broadly or to third-party integrators. The CVSS baseline is appropriate for the technical properties, but context-driven risk assessment is essential.

Frequently asked questions