PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-34170 coollabsio CVE debrief

CVE-2026-34170 is a vulnerability in Coolify, an open-source tool for managing servers, applications, and databases. The issue exists in versions prior to 4.0.0-beta.471, where the GithubApp api_url field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking. This allows an authenticated user to configure a GitHub App source that causes Coolify to request internal services or cloud metadata endpoints. The vulnerability has a CVSS score of 4.3 and is classified as MEDIUM severity.

Vendor
coollabsio
Product
coolify
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-07
Original CVE updated
2026-07-07
Advisory published
2026-07-07
Advisory updated
2026-07-07

Who should care

Users of Coolify, especially those who have not upgraded to version 4.0.0-beta.471 or later, should be aware of this vulnerability and take necessary precautions to protect their systems. This includes reviewing and restricting GitHub App configurations, monitoring system requests and logs for suspicious activity, and implementing additional security measures.

Technical summary

The vulnerability in Coolify arises from the use of the GithubApp api_url field as the base URL for server-side HTTP requests without proper allowlisting or private IP blocking. This oversight enables an authenticated user to configure a GitHub App source that can cause Coolify to request internal services or cloud metadata endpoints, potentially leading to unauthorized access or data exposure. The issue exists in versions prior to 4.0.0-beta.471.

Defensive priority

Medium

Recommended defensive actions

  • Upgrade to Coolify version 4.0.0-beta.471 or later
  • Review and restrict GitHub App configurations
  • Monitor system requests and logs for suspicious activity
  • Implement additional security measures, such as allowlisting and private IP blocking
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-07T04:17:50.357Z and last modified on 2026-07-07T15:16:44.607Z. The NVD entry is currently Deferred. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected systems and review vendor guidance for specific exposure.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-07T04:17:50.357Z and has not been modified since then. The NVD entry is currently Deferred.