CVE-2026-41896: Coolify Webhook Authentication Bypass – Unauthenticated Deployment Trigger

Technical summary

The vulnerability stems from improper initialization of the manual_webhook_secret_github field, which serves as the HMAC key for validating incoming webhook requests. When this field is null, PHP's hash_hmac() function silently coerces the null value to an empty string, causing the function to compute hash_hmac('sha256', $payload, ''). Since the payload is typically public (the webhook body from GitHub) and the key is now deterministic and empty, an attacker can independently calculate the valid HMAC-SHA256 signature. By crafting a request with the forged X-Hub-Signature-256 header containing this precomputed hash, the server accepts the request as legitimate, bypassing webhook authentication entirely. The issue affects CWE-287 (Improper Authentication).

Business impact

An attacker exploiting this vulnerability can trigger arbitrary deployments in a Coolify instance without credentials. This enables attackers to deploy malicious code, modify running applications, corrupt databases, or cause denial of service. For organizations relying on Coolify for production infrastructure, unauthorized deployments represent a critical integrity and availability threat. The attack requires no special access or prior knowledge of secrets, making it a high-risk vulnerability for any exposed Coolify instance.

Affected systems

All Coolify installations running versions prior to 4.0.0-beta.474 are affected, particularly those with applications that have not been manually assigned a webhook secret. The vulnerability is present by default in newly created applications. Organizations running self-hosted Coolify instances with GitHub webhook integrations are most at risk.

Exploitability

Exploitability is very high. The attack requires no authentication, no special network positioning, and no user interaction. An attacker needs only knowledge of the deployment payload format (typically documented or easily inferred) and the ability to send an HTTP request to the webhook endpoint. The CVSS 3.1 score of 7.5 (HIGH) reflects high network accessibility and low attack complexity, though no confidentiality impact occurs. The primary impact is integrity violation through unauthorized code deployment.

Remediation

Upgrade Coolify to version 4.0.0-beta.474 or later, which fixes the nullable webhook secret issue by ensuring a proper default or required value. Organizations should also audit existing Coolify applications to verify that webhook secrets have been explicitly set rather than left null. Additionally, review webhook request logs to detect any suspicious or unexpected deployment triggers that may indicate prior exploitation.

Patch guidance

Update Coolify to 4.0.0-beta.474 or later. If you are running a stable release branch, monitor the project's releases for a stable version incorporating this fix. Since Coolify is self-hosted, verify your current version and pull the latest container image or code from the official repository. After patching, confirm that all existing applications have non-null webhook secrets configured in the settings.

Detection guidance

Monitor Coolify webhook endpoint logs for requests with X-Hub-Signature-256 headers that lack corresponding legitimate GitHub webhook events. Look for deployment triggers that occur without corresponding code pushes or pull requests. Enable audit logging in Coolify to track all deployment events and their origins. For network-level detection, monitor for repeated attempts to access webhook endpoints from external sources, particularly with varying payloads but consistent signature patterns.

Why prioritize this

This vulnerability merits immediate patching because it enables unauthenticated code execution in a deployment context with zero complexity and no user interaction required. Any exposed Coolify instance is exploitable, and the impact directly affects infrastructure integrity and availability. The vulnerability's presence in default application configurations makes it particularly dangerous for organizations that may not have explicitly configured webhook secrets.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) appropriately reflects the severity: network-accessible attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and high integrity impact (I:H) without confidentiality or availability impact. In practice, the risk is amplified by the fact that this is a default vulnerability in newly created applications and the consequences of unauthorized deployment can be severe depending on the application's criticality.

Frequently asked questions