CVE-2026-42147: Coolify S3 Endpoint SSRF in Pre-4.0.0-beta.474 Versions

Technical summary

CVE-2026-42147 involves insufficient validation of S3 endpoint URLs in Coolify versions prior to 4.0.0-beta.474. The vulnerability stems from two weaknesses: (1) the endpoint validation logic accepts any properly formatted URL without restricting to public IP ranges or known external services, and (2) the testConnection() function performs server-side validation by requesting the configured endpoint, enabling Server-Side Request Forgery (SSRF). An authenticated user with storage management permissions can supply internal IP addresses, private DNS names, or cloud provider metadata endpoints (such as AWS EC169.254.169.254). When Coolify attempts to verify the connection, it issues HTTP requests from the server's network context, potentially leaking sensitive data through response content or error messages. CWE-918 classifies this as an improper restriction of rendered UI layers to authorized users.

Business impact

This vulnerability poses a moderate but important risk to organizations self-hosting Coolify. Compromised credentials of a storage admin or insider threats could lead to reconnaissance of internal infrastructure, theft of cloud metadata (including IAM tokens or temporary credentials), and indirect lateral movement. For multi-tenant deployments, a malicious admin could target infrastructure shared by other customers. The exposure is limited by the requirement for elevated storage permissions, reducing the blast radius compared to unauthenticated attacks. However, any organization using Coolify to manage production workloads should treat this as a priority fix to prevent credential leakage and internal network mapping.

Affected systems

All versions of Coolify prior to 4.0.0-beta.474 are affected. The vulnerability requires authentication and storage management permissions, meaning it affects deployments where admin accounts exist and are either compromised or managed by untrustworthy personnel. Self-hosted instances are the primary target; the software is not a SaaS offering, so cloud-hosted Coolify deployments managed by the vendor are not exposed. Open-source projects and companies running Coolify in air-gapped or lab environments may have lower risk, while production environments with internet-connected Coolify instances and shared admin teams face greater exposure.

Exploitability

Exploitability is moderate. An attacker must first obtain valid Coolify credentials with storage management permissions—a meaningful barrier that rules out opportunistic external exploitation. However, inside threats, compromised admin accounts (via phishing or password reuse), or overprivileged shared service accounts could enable rapid exploitation. Once authenticated, no complex steps are required; the attacker simply configures a malicious S3 endpoint URL pointing to an internal IP or metadata service and triggers a connection test. Response data or error messages may leak sensitive information without additional interaction. The attack is silent and leaves minimal forensic artifacts if not monitored.

Remediation

Upgrade Coolify to version 4.0.0-beta.474 or later. This version implements proper endpoint validation to reject internal IP ranges, private DNS names, and known metadata service endpoints before attempting connections. Organizations unable to upgrade immediately should restrict storage management permissions to a minimal set of trusted administrators, disable S3 storage features if unused, and monitor network logs from the Coolify server for suspicious outbound connections to internal or 169.254.x.x addresses. Review IAM tokens and cloud credentials for any unauthorized access following patch deployment.

Patch guidance

Upgrade to Coolify 4.0.0-beta.474 or later. Since this is a beta version, verify the release notes and test in a non-production environment first to confirm no breaking changes affect your deployment. If running a stable release and beta versions are not acceptable, check the vendor's release calendar for the stable 4.0.0 GA version or request security backports. No workarounds are available; patching is the primary remediation path. After upgrading, restart any running Coolify instances to ensure the validation logic takes effect.

Detection guidance

Monitor Coolify logs and network activity from the Coolify server for signs of SSRF exploitation. Look for: (1) HTTP requests to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or 169.254.169.254, (2) storage configuration changes made by unexpected users or at unusual times, (3) error logs referencing connection timeouts or refused connections to internal addresses, and (4) unusual DNS queries for internal hostnames from the Coolify server. Implement egress filtering on the network to prevent Coolify from reaching metadata services or internal systems. Enable detailed logging in Coolify if available and correlate with network telemetry.

Why prioritize this

This vulnerability merits prompt attention due to the potential for credential leakage and infrastructure reconnaissance, but not emergency status because exploitation requires authentication and elevated permissions. Organizations with mature identity governance, restricted admin access, and network segmentation can deprioritize slightly. Those with shared admin accounts, weak credential hygiene, or sensitive internal systems exposed to the Coolify server network should treat this as a high-priority patch within 30 days. The CVSS score of 4.9 (MEDIUM) reflects the authentication requirement while acknowledging the high confidentiality impact if exploited.

Risk score, explained

The CVSS 3.1 score of 4.9 reflects a network-accessible vulnerability (AV:N) that is easy to exploit given valid credentials (AC:L, PR:H). The attack vector requires high-privilege authentication and does not impact confidentiality of the Coolify application itself; instead, it exposes data from the server's network context, earning a High confidentiality rating (C:H) but no integrity or availability impact (I:N, A:N). The scope is unchanged (S:U), indicating the attack does not cross privilege boundaries in the target system. The MEDIUM severity balances the authentication barrier against the significant risk of credential theft and internal network exposure.

Frequently asked questions