CVE-2026-27882

mediumCVSS 4.8covered by 1 sourcefirst seen 2026-06-30

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.461, the GitLab webhook endpoint uses a non-constant-time string comparison operator (!==) to validate the webhook secret token. This implementation is vulnerable to timing attacks, which could allow an attacker to gradually discover the secret token by measuring response time differences. This vulnerability is fixed in 4.0.0-beta.461.

⚡ Watch CVE-2026-27882

Get an email if CVE-2026-27882 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.15% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all EPSS-scored CVEs.

Advisory coverage (1)

mediumCVE-2026-27882: Coolify is an open-source and self-hostable tool for managing servers, applications, and datab…nvd · 2026-06-30

External references

NVD record for CVE-2026-27882

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-27882 status](https://www.csirts.com/badge/CVE-2026-27882)](https://www.csirts.com/cve/CVE-2026-27882)