CVE-2026-27882

MEDIUM4.8

Coolify: Timing Attack in GitLab Webhook Token Validation

Published Jun 30, 2026

Modified 2 weeks ago

Details

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.461, the GitLab webhook endpoint uses a non-constant-time string comparison operator (!==) to validate the webhook secret token. This implementation is vulnerable to timing attacks, which could allow an attacker to gradually discover the secret token by measuring response time differences. This vulnerability is fixed in 4.0.0-beta.461.

References

DETECTION

https://github.com/coollabsio/coolify/security/advisories/GHSA-x525-46rq-mr8c

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-27882

CVSS Analysis

CVSS v3.1

4.8

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

LowC:L

Integrity

LowI:L

Availability

NoneA:N

4.8/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness Type (CWE)

Other

CWE-208

Ecosystems

Timeline

PublishedJun 30, 2026

ModifiedJun 30, 2026