CVE-2026-34198 Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing
Attackers can spoof the Host header to poison password reset links, stealing tokens and taking over user accounts in Coolify.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-34198?
CVE-2026-34198 is a medium-severity vulnerability in coollabsio coolify, published on 7 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the TrustProxies middleware trusts all proxies ($proxies = '*'), accepting X-Forwarded-Host from any source. The TrustHosts middleware, intended to prevent host header attacks, has a circular caching dependency that prevents it from ever validating hosts. When a password reset is requested, the ResetPassword notification generates the reset URL using url(route(..., false)), which derives the host from the (spoofable) request. An unauthenticated attacker can trigger a password reset email containing a link pointing to an attacker-controlled domain, enabling token theft and account takeover. This issue is fixed in version 4.0.0-beta.471.
Which versions are affected by CVE-2026-34198?
How do I fix CVE-2026-34198?
No fix has been published for CVE-2026-34198 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-34198 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34198 exists.
Sources
Also known as GHSA-cgj8-7m5q-x5gv.