coolify
v4.7.5An open-source, self-hostable PaaS alternative to Vercel, Heroku & Netlify that lets you easily deploy static sites, databases, full-stack applications and 360+ one-click services on your own servers.
- Maintenance
- Active2442 commits in 3 months · bus factor 1
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 30 advisories3 critical, 14 high, 6 medium, 7 low
- Supported versions
- No scheduleendoflife.date does not track this project
66.1k stars · 6k forks · 259 open issues · last release 4 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 3 critical, 14 high, 6 medium, 7 low. Check the patched version against the one you run.
- criticalCVE-2026-34037Jul 2, 2026Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()
- Affected
- < 4.0.0-beta.464
- Patched in
- 4.0.0-beta.464
- highCVE-2026-34035Jul 2, 2026Host RCE via Log Drain secret/env command injection
- Affected
- < 4.0.0-beta.466
- Patched in
- 4.0.0-beta.466
- highCVE-2026-34034Jul 2, 2026Host RCE via Sentinel token injection
- Affected
- < 4.0.0-beta.466
- Patched in
- 4.0.0-beta.466
- highCVE-2026-34044Jul 2, 2026Cross-team IDOR in logs component (resource lookup not team-scoped)
- Affected
- < 4.0.0-beta.466
- Patched in
- 4.0.0-beta.466
- mediumCVE-2026-32718Jul 2, 2026API ability mismatch allows mutation with `read` token
- Affected
- < 4.0.0-beta.466
- Patched in
- 4.0.0-beta.466
- mediumCVE-2026-41899Jul 2, 2026Unauthenticated Feedback Endpoint Allows Abuse (No Auth, No Rate Limit)
- Affected
- < 4.0.0-beta.474
- Patched in
- 4.0.0-beta.474
- lowCVE-2026-42145Jul 2, 2026File Upload Without Type or Size Validation in Database Backup Restore
- Affected
- < 4.0.0-beta.474
- Patched in
- 4.0.0-beta.474
- mediumCVE-2026-34050Jul 2, 2026Settings/Updates Livewire Component Missing isInstanceAdmin() Authorization Check
- Affected
- < 4.0.0-beta.471
- Patched in
- 4.0.0-beta.471
- lowGHSA-782c-3jq5-fw4jJul 2, 2026Multiple Low-Severity Security Issues (Email Verification Bypass, CLI Injection, Weak Hashing)
- Affected
- <= 4.0.0-beta.473
- Patched in
- 4.0.0-beta.474
- highCVE-2026-34153Jul 2, 2026Coolify RCE via LocalFileVolume `fs_path`
- Affected
- <= 4.0.0-beta.470
- Patched in
- 4.0.0-beta.471
- highCVE-2026-34152Jul 2, 2026Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport)
- Affected
- <= 4.0.0-beta.470
- Patched in
- 4.0.0-beta.471
- highCVE-2026-34058Jul 2, 2026OS Command Injection via Unmanaged Container Operations - Remote Code Execution
- Affected
- <= 4.0.0-beta.470
- Patched in
- 4.0.0-beta.471
- highCVE-2026-34057Jul 2, 2026Authenticated Remote Code Execution via Command Injection in Database Import Container Name
- Affected
- <= 4.0.0-beta.470
- Patched in
- 4.0.0-beta.471
- criticalCVE-2026-34047Jul 2, 2026WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution
- Affected
- <= 4.0.0-beta.470
- Patched in
- 4.0.0-beta.471
- criticalCVE-2026-34048Jul 2, 2026Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers
- Affected
- <= 4.0.0-beta.470
- Patched in
- 4.0.0-beta.471
- lowCVE-2026-34049Jul 2, 2026Incomplete fix for CVE-2025-66209: Command Injection via unsanitized MongoDB collection names in database backup
- Affected
- >= 4.0.0-beta.451, <= 4.0.0-beta.470
- Patched in
- 4.0.0-beta.471
- mediumCVE-2026-42147Jul 2, 2026SSRF via S3 Storage Endpoint in testConnection()
- Affected
- <= 4.0.0-beta.473
- Patched in
- 4.0.0-beta.474
- highCVE-2026-34168Jul 2, 2026Command injection via unsanitized persistent storage name in docker volume commands
- Affected
- <= 4.0.0-beta.470
- Patched in
- 4.0.0-beta.471
- highCVE-2026-34599Jul 2, 2026Authenticated Remote Code Execution in GetLogs Livewire Component
- Affected
- <= 4.0.0-beta.470
- Patched in
- 4.0.0-beta.471
- lowCVE-2026-42148Jul 2, 2026Command Injection via Unescaped Version String in Docker Build
- Affected
- <= 4.0.0-beta.473
- Patched in
- 4.0.0-beta.474
- highCVE-2026-42200Jul 2, 2026PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE
- Affected
- <= 4.0.0-beta.473
- Patched in
- 4.0.0-beta.474
- highCVE-2026-42153Jul 2, 2026PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container
- Affected
- <= 4.0.0-beta.473
- Patched in
- 4.0.0-beta.474
- highCVE-2026-42143Jul 2, 2026OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers
- Affected
- <= 4.0.0-beta.473
- Patched in
- 4.0.0-beta.474
- lowCVE-2026-42172Jul 2, 2026Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Access
- Affected
- <= 4.0.0-beta.473
- Patched in
- 4.0.0-beta.474
- lowCVE-2026-42201Jul 2, 2026OS Command Injection via Database Credential Fields in Docker Compose Service Commands
- Affected
- <= 4.0.0-beta.473
- Patched in
- 4.0.0-beta.474
- highCVE-2026-42204Jul 2, 2026Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root
- Affected
- >= 4.0.0-beta.471, <= 4.0.0-beta.473
- Patched in
- 4.0.0-beta.474
- lowCVE-2026-34149Jul 2, 2026Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs
- Affected
- < 4.0.0-beta.471
- Patched in
- 4.0.0-beta.471
- highCVE-2026-34171Jul 2, 2026Account takeover via CSRF-able GET endpoint that resets password to attacker-known value
- Affected
- < v4.0.0-beta.471
- Patched in
- v4.0.0-beta.471
- mediumCVE-2026-34198Jul 2, 2026Password reset link poisoning via X-Forwarded-Host header spoofing
- Affected
- < v4.0.0-beta.471
- Patched in
- v4.0.0-beta.471
- mediumCVE-2026-34170Jul 2, 2026Server-Side Request Forgery via attacker-controlled GitHub App API URL
- Affected
- < v4.0.0-beta.471
- Patched in
- v4.0.0-beta.471