MEDIUMCVSS v3.1 5.3Vulnerability
CVE-2026-121587
Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams via manual GitHub, GitLab, Bitbucket and Gitea webhooks. Attackers can send a repository name of % or empty with a common branch like main, exploiting unescaped LIKE wildcards to receive every matching application name before signature verification.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-03T17:20:13.885968+00:00
- Cvss score
- 5.3
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-11-03T17:21:19+00:00
- Score
- 5.3
- Last source
- NVD
- Cvss version
- 3.1
- Cve id
- CVE-2026-121587
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- First seen by Signal
- 2026-11-03T17:21:19+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Published at
- 2026-11-03T17:18:11.040
- Last modified
- 2026-11-03T17:18:11.040
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph