CVE-2026-121587
|
| |
|
|
Affected software |
GITHUB |
|
|
|
Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams via manual GitHub, GitLab, Bitbucket and Gitea webhooks. Attackers can send a repository name of % or empty with a common branch like main, exploiting unescaped LIKE wildcards to receive every matching application name before signature verification. |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2026-121587 |
