CVE-2026-27882

MediumCVSS 4.8/10Last modified Jun 30, 2026

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.461, the GitLab webhook endpoint uses a non-constant-time string comparison operator (!==) to validate the webhook secret token. This implementation is vulnerable to timing attacks, which could allow an attacker to gradually discover the secret token by measuring response time differences. This vulnerability is fixed in 4.0.0-beta.461.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-208

Affected software

No affected versions have been published.

Timeline

Published
Jun 30, 2026
Last modified
Jun 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-278835.0Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the `GET /api/vCVE-2026-278845.3NetExec is a network execution tool. Prior to version 1.5.1, the module spider_plus improperly creates the output file and folder path when CVE-2026-278857.2Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability was discovered in PiwCVE-2026-278867.5Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently saniCVE-2026-278876.9Spin is an open source developer tool for building and running serverless applications powered by WebAssembly. When Spin is configured to alCVE-2026-278887.5pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leadsCVE-2026-278897.5NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.2.0 and prior to versiCVE-2026-27899.8Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, ThunCVE-2026-278908.2Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when processing CNCT_specifiCVE-2026-278917.2FacturaScripts is an open source accounting and invoicing software. Versions 2026 and below contain a critical vulnerability in the Plugins:CVE-2026-278926.5FacturaScripts is an open source accounting and invoicing software. In versions prior to 2026, the Library module stores and serves uploadedCVE-2026-278938.8vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model