CVE-2026-100746

A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App Setup Handler. The manipulation of the argument state results in missing authentication. The attack can be executed remotely. The exploit has been made public and could be used. Upgrading to version 4.1.1 mitigates this issue. The patch is identified as fc89e357feed5180ed1ab5eb9cb330578f025539. The affected component should be upgraded.

• CWE-287
• CWE-306

• https://github.com/coollabsio/coolify/
• https://github.com/coollabsio/coolify/commit/fc89e357feed5180ed1ab5eb9cb330578f025539
• https://github.com/coollabsio/coolify/pull/10362
• https://github.com/coollabsio/coolify/releases/tag/v4.1.1
• https://github.com/lakshayyverma/CVE-Discovery/blob/main/coolify-unauth-secret-overwrite-github-app-redirect.7z
• https://vuldb.com/cve/CVE-2026-100746
• https://vuldb.com/submit/897404
• https://vuldb.com/vuln/410617
• https://vuldb.com/vuln/410617/cti

Published

Sep 27, 2026

Last Modified

Sep 28, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100739A vulnerability was detected in mathurvishal CloudClassroom-…7.3
• CVE-2026-10074DreamMaker developed by Interinfo has an Arbitrary File Read…6.9
• CVE-2026-100740A vulnerability was detected in D-Link DIR-895L A1_102b07. I…9.9
• CVE-2026-100741Eval injection in the JScript event-script dispatcher in Pro…9.8
• CVE-2026-100744A flaw has been found in coollabsio Coolify up to 4.1.2. The…7.3
• CVE-2026-100745A vulnerability has been found in Edimax BR-6428nC 1.16. The…6.3
• CVE-2026-100747Joomla Extension - svenbluege.de - CSRF in image upload in E…6.5
• CVE-2026-100748Joomla Extension - svenbluege.de - CSRF in various cart acti…8.8
• CVE-2026-100749Joomla Extension - svenbluege.de - CSRF in backend cleanup a…4.3
• CVE-2026-10075DreamMaker developed by Interinfo has a Path Traversal vulne…6.9
• CVE-2026-100750Joomla Extension - regularlabs.com - LFI / SSRF in Modules A…7.5
• CVE-2026-100751Joomla Extension - regularlabs.com - Privileged stored XSS v…6.1