Why doesn't coolify believe in publishing CVEs?

[louissanchez-vokecyber]

Reached out to the @andrasbacsai a few times via advisory, while a CVE CVE-2026-48742 was generated, nothing was published on MITRE. As a security researcher and I believe this is the case for many others, having the CVE published is pretty much the only benefit that we get from auditing your software. This leads me to believe that coolify doesn't either.

A. Take security serious
B. Appreciate security researchers
C. Both

[Cinzya]

Coolify does publish CVEs to the MITRE database. That happens automatically through Github when Andras publishes the CVE on Github. See https://docs.github.com/en/code-security/concepts/vulnerability-reporting-and-management/repository-security-advisories
And a example CVE from Coolify from the past: https://www.cve.org/CVERecord?id=CVE-2025-66211

Andras might not publish a CVE immediately until Coolify Cloud was updated. Coolify Cloud is not always on the latest version.
If this is an older CVE that has been long fixed we can poke Andras about it sometimes he just simply forgets.

He gets per day 10 vulnerability reports, each of them he is still manually reviewing. So it can happen that some things might take longer.

[louissanchez-vokecyber]

@Cinzya this was patched in v4.1.1, I've reached out several times and haven't received a response. The security advisory is still in draft -CVE-2026-48742. If you can ask what the status is I would appreciate it.