CVE-2026-57498

Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers

No known exploitation. EPSS puts it in the 31st percentile. No fix published yet.

CVSS 3.19.6Critical EPSS percentile31st0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-06-29Updated 2026-06-30Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Coollabsio CoolifyAffected: < 4.0.0-beta.474Upgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check the Coolify version you are running (look for your current installed version/build).
If you are on a version earlier than 4.0.0-beta.474, plan an upgrade to 4.0.0-beta.474 (or later) as soon as possible.
After upgrading, test that deployment actions refuse resources from other teams (e.g., try changing the URL parameters and confirm the operation is blocked).
Review who has access to Coolify and ensure only the minimum people/roles can access the web UI that performs deployments.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consistently validate server ownership with Server::whereTeamId($teamId) before any operation. However, multiple Livewire web UI components accept server_id and destination_uuid from URL query parameters without any team ownership validation, allowing cross-team resource deployment. This vulnerability is fixed in 4.0.0-beta.474.

In plain language

Written by AI from the record

CVE-2026-57498 is a Coolify weakness where logged-in users may be able to deploy apps to other teams’ servers by changing a few browser URL settings; if you run Coolify with multiple teams, you should upgrade because this can lead to other teams’ servers being used without permission.

In Coolify, multiple Livewire web UI components accept unscoped `server_id` and `destination_uuid` from URL query parameters without validating that the target server belongs to the user’s team (CWE-639 / CWE-862), enabling cross-team deployment when the attacker has access to Coolify and can reach the affected UI routes.

If you're affected

Cross-team server deployment
Unauthorized infrastructure changes
Sensitive deployment or config exposure
Operational disruption for other teams

What is it

Coolify helps teams manage servers and deploy apps. This bug is like having a form that says “pick a server,” but the server choice can be tampered with in the URL—so a user from one team might be able to point the deployment at another team’s server. If that happens, the other team can see unexpected changes (or even be affected by running apps they never approved).

Who is affected

This matters if you run Coolify and have more than one team using the same Coolify instance. It affects deployments performed through the Livewire web UI components that take server_id and destination_uuid from URL query parameters.

This is mainly a risk when an attacker has an account in your Coolify instance (so they can access the relevant UI) and can reach the affected deployment screens/routes; Coolify does not properly confirm that the target server belongs to their team.

How urgent is it

This is marked AMBER: there is no public exploit code or KEV entry showing widespread, confirmed attack activity, but the flaw is a straightforward authorization bypass tied to deployment actions. If you run Coolify for multiple teams, treat this as a real cross-team misuse risk and upgrade to the fixed release promptly.

What to do — in detail

Confirm your current deployment-management surface
- Identify how users deploy through Coolify (the web UI paths/pages that trigger deployments).
- Confirm whether your Coolify instance is used by multiple teams.
Determine whether you are affected
- Check the installed Coolify version.
- If your version is earlier than 4.0.0-beta.474, you are within the vulnerable range described for CVE-2026-57498.
Upgrade to the fixed version
- Upgrade Coolify to 4.0.0-beta.474 or later.
- After upgrade, verify the deployment workflow still works normally for your own team.
Validate the authorization fix (practical test)
- In a controlled way (ideally using a test/staging environment), attempt to change URL query parameters that influence deployment targets (specifically server_id and destination_uuid).
- Confirm Coolify blocks the action when the parameters reference a server that belongs to a different team.
If you cannot upgrade immediately (temporary containment)
- Limit access to Coolify web UI deployment functions to only required users.
- Reduce the number of users who can reach the affected Livewire UI routes (least-privilege).
- If you can isolate teams (separate Coolify instances per team), do so until the upgrade is complete.
Monitor after changes
- Watch for deployment requests that target unexpected servers/destinations, especially where the requester is not part of the destination server’s team.

Note: KEV is not listed for this CVE, and no public exploit code was found, so the main goal is to remove the authorization bypass before misuse occurs.

Technical context

CVE-2026-57498 (CWE-639 authorization failure + CWE-862 missing authorization) affects Coolify’s Livewire web UI components that accept server_id and destination_uuid from URL query parameters.

Mechanism: the affected UI components do not properly validate that the referenced server/destination belongs to the user’s team. As a result, a logged-in user can attempt cross-team deployment by manipulating those parameters.

Fix: reported fixed in 4.0.0-beta.474.

Exploitation status (per provided findings): no public exploit code on record; not listed in the CISA KEV catalog. That reduces certainty about active widespread exploitation, but the vulnerability is directly actionable for cross-team misuse.

Reachability: because the issue is associated with Livewire UI actions and requires an attacker to reach the deployment UI context, practical risk is highest for users who already have access to Coolify (i.e., are logged in / part of the UI).

Severity note: although the CVSS is very high (9.6), the operational risk posture here is AMBER due to the provided exploitation/KEV signals not showing confirmed, public exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS31st

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 31st percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

4 events over 1 day, from the signal feeds we watch.

2026-06-30Record updated
2026-06-29Publishedweakness classified, att&ck mapped

Affected products

coollabsiocommercialaka coolify
- coolifyOn-premCloud & SaaS / container-orchestration

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Scored 9.6 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability NoneNo availability impact