Coollabsio - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/coollabsio/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 27 Sep 2026 05:03:58 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthentication Bypass in Coolify GitHub App Setup Handlerhttps://feed.craftedsignal.io/briefs/2026-09-coolify-auth-bypass/Sun, 27 Sep 2026 05:03:58 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-coolify-auth-bypass/An unauthenticated remote code execution vulnerability (CVE-2026-100746) in Coolify versions 4.1.0 and earlier allows attackers to bypass authentication via the GitHub App setup flow.CVE-2026-100746 identifies a critical missing authentication vulnerability in Coolify versions up to and including 4.1.0. The vulnerability resides within the GitHub App Setup Handler, specifically affecting the Github::redirect function located in /webhooks/source/github/redirect. An attacker can manipulate the state argument within the GitHub authentication redirect flow to bypass authentication mechanisms entirely. Given that public proof-of-concept exploit material is available, this vulnerability poses an immediate risk of unauthorized access to self-hosted Coolify instances. Defenders should treat this as a high-priority update task, as exploitation is performed remotely without requiring existing credentials.

Impact

Successful exploitation allows an unauthenticated remote attacker to bypass authentication controls, potentially gaining administrative control over the Coolify instance. This could lead to full system compromise, deployment of malicious containers, and unauthorized access to managed infrastructure. All users running Coolify 4.1.0 or earlier are at risk.

Recommendation

  • Upgrade Coolify instances to version 4.1.1 or later immediately to patch CVE-2026-100746.
  • Review web access logs for anomalous POST or GET requests to the endpoint /webhooks/source/github/redirect where the state parameter appears unusually formatted or is used to facilitate unexpected redirection.
  • Verify that any Coolify instance exposed to the internet is restricted by network-level controls (e.g., VPN or IP allowlisting) while the upgrade process is underway.
]]>highadvisoryvulnerabilityweb-applicationauthentication-bypass