Timing Attack in Coolify Webhook Secret Validation

Impact Analysis

An attacker exploiting this vulnerability can gradually discover the secret webhook token used by Coolify's GitLab webhook endpoint.

With the secret token, the attacker can perform unauthorized actions such as triggering deployments or injecting malicious code into your server or applications.

The attack requires many requests and stable network conditions, making it complex, but the confidentiality impact is high because the secret token can be disclosed.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-27882 is a timing attack vulnerability in the GitLab webhook token validation of Coolify versions 4.0.0-beta.460 and earlier.

The issue arises because the webhook secret token is validated using a non-constant-time string comparison operator (`!==`). This allows attackers to exploit differences in response times to gradually discover the secret token.

By measuring how long the system takes to respond to requests with different tokens, an attacker can statistically determine each character of the secret token.

This vulnerability is fixed in version 4.0.0-beta.461 by replacing the vulnerable comparison with PHP's `hash_equals()` function, which performs constant-time comparisons and prevents timing side-channel attacks.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by observing timing differences in responses from the GitLab webhook endpoint when sending requests with varying secret tokens. An attacker can measure response times to statistically infer the secret token character by character.

To detect this on your system, you could perform timing analysis by sending multiple webhook requests with different token guesses and measuring the response times to see if there is a correlation between token correctness and response delay.

While no specific commands are provided, a typical approach involves using tools like curl or custom scripts to send repeated requests and measure response times precisely. For example, using curl in a loop with different token values and recording response times could help identify timing discrepancies.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Coolify to version 4.0.0-beta.461 or later, where the vulnerability is fixed.

The fix involves replacing the non-constant-time string comparison operator (`!==`) with PHP's `hash_equals()` function in the GitLab webhook token validation code. This change ensures constant-time comparison and prevents timing attacks.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker to gradually discover the secret webhook token through timing attacks, potentially enabling unauthorized actions such as triggering deployments or injecting malicious code.

Disclosure or misuse of secret tokens could lead to unauthorized access or data manipulation, which may impact the confidentiality and integrity of systems.

Such unauthorized access or data breaches could have implications for compliance with standards and regulations like GDPR or HIPAA, which require protection of sensitive data and secure access controls.

However, the provided information does not explicitly detail the direct impact on compliance with these standards.

Useful 0 Not Useful 0