CVE-2026-41896

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the HMAC key is the application's manual_webhook_secret_github field, which is used by Coolify's webhook endpoints to validate incoming requests, is nullable with no default — meaning newly created applications have a null webhook secret. PHP's hash_hmac() function silently coerces a null key to an empty string ''. So when the secret is null, the server computes hash_hmac('sha256', $payload, '') — a deterministic value that any attacker can calculate independently. By sending X-Hub-Signature-256: sha256=<hash_hmac('sha256', payload, '')>, an unauthenticated attacker can forge a valid signature and trigger deployments. This vulnerability is fixed in 4.0.0-beta.474.

• CWE-287

• https://github.com/coollabsio/coolify/security/advisories/GHSA-w8wm-r924-f65v
• https://github.com/coollabsio/coolify/security/advisories/GHSA-w8wm-r924-f65v

Published

Jun 29, 2026

Last Modified

Jun 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4189A weakness has been identified in phpipam up to 1.7.4. The i…4.7
• CVE-2026-41890CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a …6.9
• CVE-2026-41891CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a …5.3
• CVE-2026-41893Signal K Server is a server application that runs on a centr…7.5
• CVE-2026-41894SiYuan is an open-source personal knowledge management syste…7.1
• CVE-2026-41895changedetection.io is a free open source web page change det…7.5
• CVE-2026-41897Mantis Bug Tracker (MantisBT) is an open source issue tracke…5.3
• CVE-2026-41898rust-openssl provides OpenSSL bindings for the Rust programm…5.3
• CVE-2026-41899Coolify is an open-source and self-hostable tool for managin…6.5
• CVE-2026-4190A vulnerability was detected in JawherKl node-api-postgres u…7.3
• CVE-2026-41900OpenLearnX is an open-source, decentralized learning and ass…10
• CVE-2026-41901Thymeleaf is a server-side Java template engine for web and …9