CVE-2026-100746

A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App Setup Handler. The manipulation of the argument state results in missing authentication. The attack can be executed remotely. The exploit has been made public and could be used. Upgrading to version 4.1.1 mitigates this issue. The patch is identified as fc89e357feed5180ed1ab5eb9cb330578f025539. The affected component should be upgraded.

• CWE-287
• CWE-306

• https://github.com/coollabsio/coolify/
• https://github.com/coollabsio/coolify/commit/fc89e357feed5180ed1ab5eb9cb330578f025539
• https://github.com/coollabsio/coolify/pull/10362
• https://github.com/coollabsio/coolify/releases/tag/v4.1.1
• https://github.com/lakshayyverma/CVE-Discovery/blob/main/coolify-unauth-secret-overwrite-github-app-redirect.7z
• https://vuldb.com/cve/CVE-2026-100746
• https://vuldb.com/submit/897404
• https://vuldb.com/vuln/410617
• https://vuldb.com/vuln/410617/cti

Published

Sep 27, 2026

Last Modified

Sep 27, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10073DreamMaker developed by Interinfo has an Arbitrary File Read…8.7
• CVE-2026-100739A vulnerability was detected in mathurvishal CloudClassroom-…7.3
• CVE-2026-10074DreamMaker developed by Interinfo has an Arbitrary File Read…6.9
• CVE-2026-100740A vulnerability was detected in D-Link DIR-895L A1_102b07. I…9.9
• CVE-2026-100744A flaw has been found in coollabsio Coolify up to 4.1.2. The…7.3
• CVE-2026-100745A vulnerability has been found in Edimax BR-6428nC 1.16. The…6.3
• CVE-2026-10075DreamMaker developed by Interinfo has a Path Traversal vulne…6.9
• CVE-2026-10077The yootheme WordPress theme before 5.0.35 does not prevent …6.8
• CVE-2026-10078A flaw was found in the Quay config-tool's GitLab OAuth vali…2.7
• CVE-2026-10079A flaw was found in Red Hat Advanced Cluster Security for Ku…8.5
• CVE-2026-1008A stored cross-site scripting (XSS) vulnerability exists in …5.4
• CVE-2026-10080Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 1…6.5