CVE-2026-34198: Coolify Password Reset Host Header Injection Leading to Account Takeover

Technical summary

Coolify's TrustProxies middleware is configured to accept X-Forwarded-Host headers from any source (wildcard '*'), creating a vector for host header spoofing. The TrustHosts middleware, designed to mitigate such attacks through host validation, contains a circular caching dependency that prevents validation logic from ever executing. When a password reset is initiated, the ResetPassword notification constructs the reset URL using url(route(..., false)), which derives the host from the incoming request rather than a validated source. An attacker can craft requests that cause Coolify to generate password reset emails with malicious URLs pointing to attacker-controlled infrastructure. Because the reset token is embedded in the URL and sent via email, token interception compromises the user account.

Business impact

Account takeover poses direct operational and reputational risk. Attackers gaining administrative access to Coolify instances can modify server configurations, access stored credentials for managed databases and applications, exfiltrate sensitive data, or inject malicious workloads. For organizations using Coolify in production, a compromised instance effectively compromises all downstream infrastructure it manages. Credential theft of end-users via poisoned reset emails further extends the attack surface to other services those users access.

Affected systems

Coolify versions prior to 4.0.0-beta.471 are vulnerable. The vulnerability affects self-hosted Coolify deployments accessible via network requests—typically instances exposed to the internet or within trusted networks. Any user with an email address registered in a Coolify instance is a potential target.

Exploitability

Exploitation requires no authentication and minimal technical sophistication: an attacker triggers a password reset for a target user, observes or influences the resulting email (via phishing pretext, network position, or email compromise), and intercepts the reset token. The attack requires user interaction (clicking the link) but leverages trust in email communications from the server. The attack vector is network-accessible, and while attack complexity is marked as high in the CVSS metric (likely due to the user-interaction requirement), the underlying technical components are straightforward to exploit.

Remediation

Upgrade Coolify to version 4.0.0-beta.471 or later. This release fixes the TrustHosts middleware circular dependency and corrects the password reset URL generation to use validated host information rather than untrusted request headers.

Patch guidance

Apply the upgrade to 4.0.0-beta.471 as soon as feasible. Before patching, verify that backup and restore procedures are tested, as this is a beta release. For instances that cannot be immediately upgraded, implement network-level mitigations: restrict X-Forwarded-Host header propagation at reverse proxies or load balancers, whitelist only trusted proxy sources, and configure email filtering to flag suspicious password reset links or domains.

Detection guidance

Monitor Coolify logs and reverse proxy/load balancer logs for X-Forwarded-Host headers containing unexpected domains. Watch for password reset requests followed by immediate login attempts from unusual IP addresses or geographic locations. Correlate password reset emails sent to users with the destinations embedded in those emails—legitimate resets should reference your own domain. SIEM or log aggregation tools can flag patterns of distributed password reset requests targeting multiple accounts, suggesting automated reconnaissance.

Why prioritize this

Although the CVSS score is moderate (5.3), the vulnerability enables direct account takeover with minimal attacker effort and no authentication requirement. Coolify often manages critical infrastructure, making compromise of an administrative instance particularly damaging. Organizations running internet-facing or production Coolify instances should prioritize this patch. The combination of weak proxy validation, broken host verification, and user-facing password reset makes this a practical attack vector in real deployments.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects network accessibility, no privilege requirement, and no authentication barrier, balanced against high attack complexity and required user interaction (clicking the reset link). However, the integrity impact is rated high because account takeover enables unauthorized modification of managed infrastructure. The score appropriately captures the technical difficulty but may underweight the operational severity for production Coolify deployments managing critical systems. Security teams should consider this a priority above its numeric score suggests.

Frequently asked questions