---
id: CVE-2026-121587
title: Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints
summary: >-
  Coolify before 4.1.1 contains an information disclosure vulnerability that
  allows unauthenticated attackers to enumerate application names across all
  teams via manual GitHub, GitLab, Bitbucket and Gitea webhooks. Attackers can
  send a rep…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-200
vendor: coollabsio
product: coolify
affected:
  - coolify < 4.1.1
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-07T03:13:00.919667Z'
published: '2026-11-03'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T03:13:17.112Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121587'
references:
  - url: 'https://github.com/coollabsio/coolify/pull/10361'
  - url: >-
      https://github.com/coollabsio/coolify/commit/c1518ba1c0be36da42b6cef06df4b042f5733b01
  - url: >-
      https://github.com/coollabsio/coolify/commit/809d9b21fa9609de2ce9b49bb838c079598da876
  - url: 'https://github.com/coollabsio/coolify/releases/tag/v4.1.1'
    label: coolify v4.1.1 Release Notes
  - url: >-
      https://github.com/coollabsio/coolify/blob/v4.1.0/app/Http/Controllers/Webhook/Github.php#L69
  - url: 'https://github.com/coollabsio/coolify'
  - url: >-
      https://www.vulncheck.com/advisories/coolify-before-4.1.1-application-name-enumeration-via-manual-webhook-endpoints
    label: >-
      VulnCheck Advisory: Coolify before 4.1.1 Application Name Enumeration via
      Manual Webhook Endpoints
tags:
  - cve.org
epss: 0.00273
epssPercentile: 0.19815
ingestedAt: '2026-11-05T20:33:06.280Z'
---

## Overview

Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams via manual GitHub, GitLab, Bitbucket and Gitea webhooks. Attackers can send a repository name of % or empty with a common branch like main, exploiting unescaped LIKE wildcards to receive every matching application name before signature verification.

## Affected

- `coolify < 4.1.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.