coollabsio has 3 CVEs on record. 3 were published in the last 90 days. The busiest recent month was September 2026 with 3. The median CVSS is 7.3 (high).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.3
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-86117High· 8.1Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities.…45CVE-2026-100746High· 7.3A vulnerability was found in coollabsio Coolify up to 4.1.040CVE-2026-100744High· 7.3A flaw has been found in coollabsio Coolify up to 4.1.240
coollabsio vulnerabilities
CVEs affecting coollabsio, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-100746High· 7.3A vulnerability was found in coollabsio Coolify up to 4.1.0
A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App Setup Handler. The manipulation of the argument state result…
CVE-2026-100744High· 7.3A flaw has been found in coollabsio Coolify up to 4.1.2
A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to miss…
CVE-2026-86117High· 8.1Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities.…
Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities.…