---
id: "CVE-2026-121587"
kind: "vulnerability"
aliases: ["CVE-2026-121587"]
title: "Coolify: unauthenticated webhooks leak application names across all teams"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["coolify", "runtime", "self-hosted", "webhooks"]
not_affected_if: ["managed-hosting", "webhooks-not-exposed"]
published_at: "2026-11-03T17:18:11+00:00"
first_seen_at: "2026-11-03T17:21:56+00:00"
updated_at: "2026-11-03T17:24:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121587", "first_seen_at": "2026-11-03T17:21:56+00:00"}]
---

# Coolify: unauthenticated webhooks leak application names across all teams

Coolify before 4.1.1 has manual GitHub, GitLab, Bitbucket and Gitea webhook endpoints that accept a wildcard repository name before signature checks. An unauthenticated attacker can list the names of applications belonging to every team on the instance.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Coolify version: `coolify --version` or the version shown in the Coolify dashboard, and compare it with `4.1.1`.
- Note whether manual Git webhooks (GitHub, GitLab, Bitbucket, Gitea) are configured on the instance.

## Fix

- Coolify: upgrade to `4.1.1` or later.

## Timeline

- 2026-11-03T17:21:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121587

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/coolify-before-4.1.1-application-name-enumeration-via-manual-webhook-endpoints
- [fix] Patch: github.com https://github.com/coollabsio/coolify/commit/809d9b21fa9609de2ce9b49bb838c079598da876
- [fix] Patch: github.com https://github.com/coollabsio/coolify/commit/c1518ba1c0be36da42b6cef06df4b042f5733b01
- [fix] Release notes: github.com https://github.com/coollabsio/coolify/releases/tag/v4.1.1

## From the sources

Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams via manual GitHub, GitLab, Bitbucket and Gitea webhooks. Attackers can send a repository name of % or empty with a common branch like main, exploiting unescaped LIKE wildcards to receive every matching application name before signature verification.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_