What is CVE-2026-27882?

CVE-2026-27882 is a medium-severity vulnerability in Coollabsio Coolify, classified under CWE-208. CVSS score: 4.8/10. Published 2026-06-30.

How severe is CVE-2026-27882?

Medium severity. CVSS v3 base score is 4.8 out of 10.

Vulnerability in Coollabsio Coolify

CVE-2026-27882

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.461, the GitLab webhook endpoint uses a non-constant-time string comparison operator (!==) to validate the webhook secret token. This implementation is vulnerable to timing attacks, which could allow an attacker to gradually discover the secret token by measuring response time differences. This vulnerability is fixed in 4.0.0-beta.461.

EPSS: 0.001 (4.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N.

Affected products

Coollabsio Coolify — versions < 4.0.0-beta.461

Weakness classification (CWE)

CWE-208

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-27882?: CVE-2026-27882 is a medium-severity vulnerability in Coollabsio Coolify, classified under CWE-208. CVSS score: 4.8/10. Published 2026-06-30.
How severe is CVE-2026-27882?: Medium severity. CVSS v3 base score is 4.8 out of 10.