CVE-2026-27882

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27882", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-24T15:19:29.715Z", "datePublished": "2026-06-30T14:26:44.422Z", "dateUpdated": "2026-06-30T15:58:02.524Z"}, "containers": {"cna": {"title": "Coolify: Timing Attack in GitLab Webhook Token Validation", "problemTypes": [{"descriptions": [{"cweId": "CWE-208", "lang": "en", "description": "CWE-208: Observable Timing Discrepancy", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/coollabsio/coolify/security/advisories/GHSA-x525-46rq-mr8c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-x525-46rq-mr8c"}], "affected": [{"vendor": "coollabsio", "product": "coolify", "versions": [{"version": "< 4.0.0-beta.461", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-30T14:26:44.422Z"}, "descriptions": [{"lang": "en", "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.461, the GitLab webhook endpoint uses a non-constant-time string comparison operator (!==) to validate the webhook secret token. This implementation is vulnerable to timing attacks, which could allow an attacker to gradually discover the secret token by measuring response time differences. This vulnerability is fixed in 4.0.0-beta.461."}], "source": {"advisory": "GHSA-x525-46rq-mr8c", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-x525-46rq-mr8c", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-30T15:49:02.818184Z", "id": "CVE-2026-27882", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-30T15:58:02.524Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27882", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-30T15:49:02.818184Z"}}}], "references": [{"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-x525-46rq-mr8c", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-30T15:49:11.759Z"}}], "cna": {"title": "Coolify: Timing Attack in GitLab Webhook Token Validation", "source": {"advisory": "GHSA-x525-46rq-mr8c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "coollabsio", "product": "coolify", "versions": [{"status": "affected", "version": "< 4.0.0-beta.461"}]}], "references": [{"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-x525-46rq-mr8c", "name": "https://github.com/coollabsio/coolify/security/advisories/GHSA-x525-46rq-mr8c", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.461, the GitLab webhook endpoint uses a non-constant-time string comparison operator (!==) to validate the webhook secret token. This implementation is vulnerable to timing attacks, which could allow an attacker to gradually discover the secret token by measuring response time differences. This vulnerability is fixed in 4.0.0-beta.461."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-208", "description": "CWE-208: Observable Timing Discrepancy"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-30T14:26:44.422Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27882", "state": "PUBLISHED", "dateUpdated": "2026-06-30T15:58:02.524Z", "dateReserved": "2026-02-24T15:19:29.715Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-30T14:26:44.422Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "coolify", "vendor": "coollabsio", "versions": [{"status": "affected", "version": "< 4.0.0-beta.461"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.461, the GitLab webhook endpoint uses a non-constant-time string comparison operator (!==) to validate the webhook secret token. This implementation is vulnerable to timing attacks, which could allow an attacker to gradually discover the secret token by measuring response time differences. This vulnerability is fixed in 4.0.0-beta.461."}, {"lang": "es", "value": "Coolify es una herramienta de c\u00f3digo abierto y autoalojable para gestionar servidores, aplicaciones y bases de datos. Antes de la versi\u00f3n 4.0.0-beta.461, el endpoint del webhook de GitLab utiliza un operador de comparaci\u00f3n de cadenas de tiempo no constante (!==) para validar el token secreto del webhook. Esta implementaci\u00f3n es vulnerable a ataques de temporizaci\u00f3n, lo que podr\u00eda permitir a un atacante descubrir gradualmente el token secreto midiendo las diferencias en el tiempo de respuesta. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 4.0.0-beta.461."}], "id": "CVE-2026-27882", "lastModified": "2026-10-25T21:10:00.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27882", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-30T15:49:02.818184Z", "version": "2.0.3"}}]}, "published": "2026-06-30T15:16:52.263", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-x525-46rq-mr8c"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-x525-46rq-mr8c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-208"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.0.0-beta.461)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "coolify", "source": "cna", "vendor": "coollabsio"}, "product": "coolify", "vendor": "coollabsio"}], "created": "2026-06-30T16:30:16.050547+00:00", "updated": "2026-06-30T20:45:03.383805+00:00", "vendors": ["coollabsio", "coollabsio$PRODUCT$coolify"]}