CVE-2026-27956

MEDIUM

Coolify: Cross-team application domain enumeration via domains_by_server endpoint

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-27956. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-27956, an authentication bypass vulnerability in Coolify (prior to 4.0.0-beta.464). The code includes placeholder methods (`check()` and `run()`) but lacks actual exploit logic, referencing only a GitHub advisory for details.

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, `GET /api/v1/servers/{server_uuid}/domains?uuid={app_uuid}` bypasses team scoping when the optional uuid query parameter is provided. Any authenticated API user can enumerate domain names (FQDNs) of applications belonging to other teams. This vulnerability is fixed in 4.0.0-beta.464.

Exploits (1)

github STUB 1 stars
by HermesNA-1 · pythonpoc
https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-27956_coolify_open-source.py

This repository contains an auto-generated stub module for CVE-2026-27956, an authentication bypass vulnerability in Coolify (prior to 4.0.0-beta.464). The code includes placeholder methods (`check()` and `run()`) but lacks actual exploit logic, referencing only a GitHub advisory for details.

Classification
Stub 98%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Theoretical
Target: Coolify (versions prior to 4.0.0-beta.464)
No auth needed
Prerequisites: Network access to the Coolify API endpoint (`/api/v1/servers/{server_uuid}/domains?uuid={app_uuid}`) · Valid `server_uuid` and `app_uuid` values (though the exploit may bypass team scoping)
mistral-large-3 · analyzed Jul 09, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 4.3
EPSS 0.0018
EPSS Percentile 7.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-639
Status published
Products (1)
coollabsio/coolify < 4.0.0-beta.464
Published Jun 30, 2026
Tracked Since Jun 30, 2026