CVE-2026-41896

{
  "id": "CVE-2026-41896",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-29T21:16:44.280",
  "lastModified": "2026-10-25T21:10:00.770",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the HMAC key is the application's manual_webhook_secret_github field, which is used by Coolify's webhook endpoints to validate incoming requests, is nullable with no default — meaning newly created applications have a null webhook secret. PHP's hash_hmac() function silently coerces a null key to an empty string ''. So when the secret is null, the server computes hash_hmac('sha256', $payload, '') — a deterministic value that any attacker can calculate independently. By sending X-Hub-Signature-256: sha256=<hash_hmac('sha256', payload, '')>, an unauthenticated attacker can forge a valid signature and trigger deployments. This vulnerability is fixed in 4.0.0-beta.474."
    },
    {
      "lang": "es",
      "value": "Coolify es una herramienta de código abierto y autoalojable para gestionar servidores, aplicaciones y bases de datos. Antes de la versión 4.0.0-beta.474, la clave HMAC es el campo manual_webhook_secret_github de la aplicación, que es utilizado por los puntos finales de webhook de Coolify para validar las solicitudes entrantes, es anulable sin valor predeterminado, lo que significa que las aplicaciones recién creadas tienen un secreto de webhook nulo. La función hash_hmac() de PHP coacciona silenciosamente una clave nula a una cadena vacía ’’. Así, cuando el secreto es nulo, el servidor calcula hash_hmac(’sha256’, $payload, ’’) - un valor determinista que cualquier atacante puede calcular de forma independiente. Al enviar X-Hub-Signature-256: sha256=<hash_hmac(’sha256’, payload, ’’)>, un atacante no autenticado puede falsificar una firma válida y activar despliegues. Esta vulnerabilidad se corrige en la versión 4.0.0-beta.474."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "coollabsio",
          "product": "coolify",
          "versions": [
            {
              "version": "< 4.0.0-beta.474",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-30T12:55:46.494918Z",
          "id": "CVE-2026-41896",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-w8wm-r924-f65v",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-w8wm-r924-f65v",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}