CVE-2026-57498: Coollabsio Coolify

Critical severity, CVSS 9.6. EPSS: 0.4% chance of exploitation in the next 30 days.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consistently validate server ownership with Server::whereTeamId($teamId) before any operation. However, multiple Livewire web UI components accept server_id and destination_uuid from URL query parameters without any team ownership validation, allowing cross-team resource deployment. This vulnerability is fixed in 4.0.0-beta.474.

Affected products

• Coollabsio Coolify: before 4.0.0-beta.474 (fixed in 4.0.0-beta.474)

Published 2026-06-29. Last modified 2026-06-30.