CVE-2026-42172: Coolify API Tokens Do Not Expire—Indefinite Access Risk

Technical summary

CVE-2026-42172 stems from missing token expiration logic in Coolify's Sanctum-based API authentication layer. Sanctum is Laravel's token-based authentication guard; the implementation prior to 4.0.0-beta.474 did not enforce expiration timestamps on issued tokens. When an attacker obtains a valid token via disclosure, network capture, or supply chain compromise, they can make authenticated API requests to the Coolify instance without time-bound constraints. The vulnerability is classified under CWE-613 (Insufficient Session Expiration), reflecting the fundamental lack of temporal controls on authentication credentials. An authenticated attacker with an intercepted token gains the same API permissions as the user who originally obtained it.

Business impact

For organizations self-hosting Coolify, this vulnerability creates persistent unauthorized access risk. If a token leaks—whether through logs, misconfigured backups, or accidental exposure in version control—an attacker retains indefinite API access to that Coolify instance. This could allow lateral movement, data exfiltration, or destructive actions against hosted applications and databases without the organization detecting the compromise through normal token rotation cycles. The practical impact depends on what the compromised token can do (read-only vs. administrative) and whether the organization monitors for suspicious API activity. Smaller teams managing Coolify without comprehensive API audit logging face elevated risk.

Affected systems

Coolify versions prior to 4.0.0-beta.474 are affected. Coolify is an open-source, self-hosted platform; there is no official commercial distribution or bundled vendor product. Any organization running Coolify on-premises or in their own infrastructure with a version older than 4.0.0-beta.474 should be considered at risk, especially if token-based API integrations or automation are in use.

Exploitability

The CVSS 3.1 score of 3.1 (LOW severity) reflects several factors: an attacker must already have obtained a valid API token (PR:L—requires prior authentication), network access is required (AV:N), and the attack complexity is high (AC:H), likely because token discovery itself is not trivial outside of specific disclosure scenarios. Once a token is in hand, however, exploitation is straightforward—the attacker simply uses it in API calls. The token does not expire on its own, so there is no time window or additional actions needed. This is not actively exploited in the wild (KEV status: false), but the simplicity of token reuse and the indefinite validity window make this a persistent threat if tokens leak through common channels.

Remediation

Upgrade Coolify to version 4.0.0-beta.474 or later. The patch implements token expiration logic, ensuring that new tokens issued after the upgrade have a defined lifespan. Tokens issued before the upgrade will not automatically expire; as a defense-in-depth measure, administrators should manually revoke any tokens known or suspected to have been exposed. Consider rotating all active API tokens after upgrade to limit the window in which pre-patch tokens remain valid. Additionally, review API access logs (if available) for suspicious activity during the time any token may have been compromised.

Patch guidance

Update Coolify to 4.0.0-beta.474 or any stable release after this beta version. Because this is a beta release, verify that your Coolify deployment supports upgrading to beta versions or wait for the corresponding stable release. Test the upgrade in a non-production environment first to ensure compatibility with your current configuration, especially if you have custom API integrations or automation scripts. After upgrade, regenerate any manually-created API tokens and configure token rotation policies in your CI/CD pipelines and integrations.

Detection guidance

Monitor Coolify API logs for unexpected authentication or API calls from unfamiliar IP addresses or user agents, particularly for administrative operations (server provisioning, database changes, application deployments). If audit logging is available, review token creation and revocation history to identify gaps or suspicious patterns. Conduct a post-incident review by cross-referencing API activity logs against known users and authorized integrations; anomalies may indicate leaked tokens in use. Implement API rate limiting and behavioral alerting to catch unusual patterns of API consumption.

Why prioritize this

Although the CVSS score is low, this vulnerability merits prompt attention in organizations running Coolify because the impact of token leakage is indefinite and potentially high-consequence. The patch is available and straightforward to apply. Prioritize this for environments where Coolify manages critical infrastructure, databases, or sensitive applications. For smaller Coolify deployments managing non-critical workloads, defer to routine patching cycles, but do not skip this update.

Risk score, explained

The CVSS 3.1 score of 3.1 reflects a low base severity driven by the requirement for prior authentication (PR:L) and high attack complexity (AC:H), indicating that an attacker must first obtain a valid token. However, once obtained, the indefinite validity of the token compounds the risk in practice. The score does not account for environmental factors such as token logging, secrets management practices, or the criticality of systems exposed via Coolify, which may elevate organizational risk beyond the base score.

Frequently asked questions