CVE-2026-34171: Coolify Password Reset CSRF Vulnerability (v4.0.0-beta.470 and Earlier)

Technical summary

CVE-2026-34171 is a Cross-Site Request Forgery (CWE-352) vulnerability in Coolify's invitation endpoint. The GET /invitations/{uuid} endpoint performs a state-changing operation—password reset—without proper CSRF protections or confirmation mechanisms. An attacker with knowledge of or ability to predict an invitation UUID can initiate a password reset by inducing a victim to visit a crafted invitation URL. The password is set to a predictable value, allowing the attacker to subsequently authenticate as the victim. The vulnerability requires user interaction and network-level reachability to the Coolify instance, but imposes no authentication or privilege requirements on the attacker.

Business impact

Unauthorized account takeover of Coolify administrators or operators represents a critical operational risk. An attacker gaining control of a Coolify instance obtains administrative authority over all managed servers, applications, and databases, potentially leading to data breaches, service disruption, and supply-chain compromise if the instance manages infrastructure for multiple clients or projects. The attack is low-cost, scalable via phishing or watering-hole techniques, and difficult to detect if the attacker moves quickly to change credentials and cover tracks.

Affected systems

Coolify versions prior to 4.0.0-beta.471 are affected. The vulnerability applies to any self-hosted Coolify deployment, regardless of operating system or container runtime, provided the instance is reachable over the network and users can be induced to click a malicious link. Self-hosted deployments behind private networks or with network segmentation face reduced exposure but remain vulnerable if the attacker gains internal network access or compromises a trusted communication channel.

Exploitability

The attack has a CVSS exploitability rating reflecting medium complexity (AC:H) due to the requirement for user interaction, but the attack surface is broad: any Coolify user with a known or guessable UUID can be targeted. The attacker does not need credentials or special privileges. Automation is straightforward—an attacker can generate multiple UUIDs, craft phishing emails with invitation URLs, and await successful clicks. Detection is challenging because the password reset appears legitimate in server logs if logging is not granular.

Remediation

Upgrade Coolify to version 4.0.0-beta.471 or later immediately. This release implements CSRF protections on the invitation endpoint, likely including token-based verification and/or POST-only state-changing operations. Verify the upgrade in a non-production environment first to ensure compatibility with any custom configurations or plugins.

Patch guidance

1. Identify all Coolify instances in your environment and their current versions (check the UI, API, or container image tag). 2. Plan a maintenance window, as restarting the Coolify service may be necessary during the upgrade. 3. Back up your Coolify configuration and database before upgrading. 4. Pull or build the 4.0.0-beta.471 image and perform a staged rollout if managing multiple instances. 5. Test core functionality (invitations, password resets, server management) post-upgrade. 6. Reset passwords for any accounts that may have been compromised during the vulnerability window.

Detection guidance

Review Coolify access logs and database audit logs for: (1) invitations generated without corresponding legitimate user action; (2) password reset events triggered by GET requests (vs. expected POST requests); (3) successful logins from new IP addresses or user-agents shortly after invitation generation; (4) changes to admin accounts or credentials that were not user-initiated. Enable verbose audit logging on the invitation and authentication endpoints if not already active. Cross-reference invitation UUIDs in logs with expected business processes.

Why prioritize this

This vulnerability merits immediate remediation despite not being on the KEV catalog. The CVSS 8.0 HIGH rating reflects the combination of high confidentiality and integrity impact, network accessibility, and the low barrier to attack execution. The simplicity of exploitation, scalability via phishing, and the catastrophic impact of administrative account compromise on self-hosted infrastructure justify treating this as a priority patch within 30 days, and urgent within 7 days for internet-facing instances.

Risk score, explained

The score of 8.0 reflects: (1) HIGH confidentiality impact (attacker gains full account access and potentially secrets managed by Coolify); (2) HIGH integrity impact (attacker can modify infrastructure, applications, and data); (3) NO availability impact (attacker controls rather than destroys); (4) network attack vector (remotely exploitable); (5) user interaction required (moderate complexity); and (6) changed scope (CVSS 'C' indicates the compromise affects resources beyond the vulnerable component). The absence of pre-exploitation credential requirements and the ease of social engineering lower the barrier to attack.

Frequently asked questions