Authentication Bypass in Coolify GitHub App Setup Handler

CVE-2026-100746 identifies a critical missing authentication vulnerability in Coolify versions up to and including 4.1.0. The vulnerability resides within the GitHub App Setup Handler, specifically affecting the Github::redirect function located in /webhooks/source/github/redirect. An attacker can manipulate the state argument within the GitHub authentication redirect flow to bypass authentication mechanisms entirely. Given that public proof-of-concept exploit material is available, this vulnerability poses an immediate risk of unauthorized access to self-hosted Coolify instances. Defenders should treat this as a high-priority update task, as exploitation is performed remotely without requiring existing credentials.

Impact

Successful exploitation allows an unauthenticated remote attacker to bypass authentication controls, potentially gaining administrative control over the Coolify instance. This could lead to full system compromise, deployment of malicious containers, and unauthorized access to managed infrastructure. All users running Coolify 4.1.0 or earlier are at risk.

Recommendation

• Upgrade Coolify instances to version 4.1.1 or later immediately to patch CVE-2026-100746.
• Review web access logs for anomalous POST or GET requests to the endpoint /webhooks/source/github/redirect where the state parameter appears unusually formatted or is used to facilitate unexpected redirection.
• Verify that any Coolify instance exposed to the internet is restricted by network-level controls (e.g., VPN or IP allowlisting) while the upgrade process is underway.