CVE-2026-42147 is a Server-Side Request Forgery (SSRF) vulnerability in coollabsio's Coolify product. Before version 4.0.0-beta.474, the S3 storage endpoint validation only verified the URL format without restricting the destination. The testConnection() method sends a server-side HTTP request to the configured S3 endpoint, which allows an authenticated user with storage management permissions to induce Coolify to make requests to internal network resources or metadata service URLs. This could lead to unauthorized information disclosure. The vulnerability is resolved in version 4.0.0-beta.474.

An authenticated user with storage management permissions can exploit this SSRF vulnerability to make the Coolify server send requests to internal or metadata-service URLs. This can lead to unauthorized disclosure of sensitive internal information. The CVSS score of 4.9 indicates a medium severity impact with high confidentiality impact but no integrity or availability impact.

A fix is available in Coolify version 4.0.0-beta.474. Users should upgrade to this version or later to remediate the vulnerability. Since Coolify is a cloud service, the vendor manages remediation for the cloud-hosted service; users should verify with the vendor that the service is updated. No additional mitigation steps are indicated by the vendor advisory.