Back to overview

CVE-2026-42172

LOW Exploitation: PoC
3.1
CVSS 3.1
Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Sanctum API tokens did not expire, allowing a leaked token to retain access indefinitely until manually revoked. This issue is fixed in version 4.0.0-beta.474.

Metadata

CVE ID
CVE-2026-42172
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-04-25 01:53 UTC
Published
2026-07-07 02:52 UTC
Last updated
2026-07-07 13:57 UTC
Primary CWE
CWE-613
CWE-613: Insufficient Session Expiration
Vendor / Product
coollabsio / coolify
Sources
cve.org  ·  NVD

Severity & Metrics

3.1 LOW CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
coollabsio coolify — < 4.0.0-beta.474
Weakness (CWE)
CWESourceDescription
CWE-613 cna CWE-613: Insufficient Session Expiration
CVSS scores (1)
ScoreSeverityVersionSourceVector
3.1 LOW 3.1 cna CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
References (4)
Back to overview