Description Summary:
Coolify before 4.2.0 fails to sanitize environment variable keys in Docker commands, allowing authenticated users to inject shell metacharacters and execute arbitrary commands on the host server.

Executive Summary:
A critical command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary code on the underlying host server by manipulating environment variable keys.

Vulnerability Details

CVE-ID: CVE-2026-84694

Affected Software: Coolify Coolify

Affected Versions: 0 up to (excluding) 4.2.0

Vulnerability: This is an OS command injection vulnerability (CWE-78) occurring because the application fails to properly escape environment variable key names before passing them to Docker commands executed over SSH. An authenticated attacker can inject shell metacharacters into these keys to escape the intended context and execute commands on the host operating system.

Business Impact

Successful exploitation grants an attacker full control over the host server running the Coolify instance, which may lead to total system compromise, data exfiltration, and lateral movement within the network. Given the CVSS score of 8.8, this vulnerability represents a high risk to organizational security and infrastructure integrity. The ability to execute commands outside of containers effectively bypasses the containerization security boundary, rendering the host environment vulnerable.

Remediation Plan

Immediate Action: Update the Coolify installation to version 4.2.0 or later immediately to apply the necessary input validation fixes.

Proactive Monitoring: Review server access logs and Docker command execution logs for any anomalous shell command patterns or unexpected environment variable configurations.

Compensating Controls: Restrict access to the Coolify management interface to authorized personnel only via network-level controls, and ensure the service is running with the least privilege necessary on the host.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of September 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the direct path from a controlled input field to host-level command execution.

Analyst Recommendation

The severity of this vulnerability, combined with its ability to facilitate remote code execution on the host, necessitates immediate attention. Administrators must prioritize updating to version 4.2.0 to eliminate the injection vector. Failure to patch this vulnerability leaves the host server exposed to full system takeover by any authenticated user.

Description Summary:
Coolify is vulnerable to OS Command Injection, allowing an authenticated user to execute arbitrary commands on the underlying server.

Executive Summary:
An OS command injection vulnerability in Coolify allows authenticated attackers to achieve remote code execution, posing a critical risk to self-hosted server environments.

Vulnerability Details

CVE-ID: CVE-2026-59734

Affected Software: Coollabs Coolify

Affected Versions: < 4.0.0-beta.469

Vulnerability: This vulnerability is an OS Command Injection (CWE-78) flaw. An attacker with low-level authenticated access can manipulate input parameters to inject and execute arbitrary system commands on the host server.

Business Impact

Successful exploitation allows an attacker to gain full control over the server hosting the Coolify instance. With a CVSS score of 8.8, this vulnerability carries a high risk of total system compromise, unauthorized data access, and the potential for lateral movement into the wider network infrastructure.

Remediation Plan

Immediate Action: Upgrade Coolify to version 4.0.0-beta.469 or later immediately to include the necessary input neutralization patches.

Proactive Monitoring: Review system and application logs for unusual process execution patterns or unexpected shell invocations originating from the Coolify service account.

Compensating Controls: Implement strict network segmentation and ensure the application runs with the least privilege necessary to limit the blast radius of a potential command injection.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of potential remote code execution, administrators should prioritize updating their Coolify instances. Ensure that all security patches are applied and verify that the application is isolated from sensitive internal resources.

Description Summary:
Coolify versions prior to 4.0.0-beta.474 contain an authorization flaw where Livewire web UI components fail to validate resource ownership, enabling cross-team resource manipulation.

Executive Summary:
A critical authorization bypass in Coolify allows attackers to perform cross-team resource deployments by exploiting missing ownership validation in web UI components.

Vulnerability Details

CVE-ID: CVE-2026-57498

Affected Software: coollabsio coolify

Affected Versions: Prior to 4.0.0-beta.474

Vulnerability: The vulnerability stems from a failure in Livewire components to validate server_id and destination_uuid parameters against the authenticated user's team ID. Unlike the backend API controllers, the UI components do not perform the necessary authorization checks, allowing authenticated users to manipulate resources belonging to other teams.

Business Impact

Successful exploitation allows unauthorized users to modify or deploy resources across different team environments, breaking multi-tenancy isolation. With a CVSS score of 9.6, this vulnerability poses a severe risk to the integrity and confidentiality of self-hosted infrastructure, potentially allowing lateral movement within the Coolify ecosystem.

Remediation Plan

Immediate Action: Upgrade to Coolify version 4.0.0-beta.474 or later to ensure all UI components correctly enforce server and destination ownership.

Proactive Monitoring: Inspect deployment logs for any unauthorized resource creation or changes that do not align with current team assignments.

Compensating Controls: Restrict access to the Coolify administrative dashboard to trusted internal networks and audit user permissions to ensure the principle of least privilege.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical nature of the flaw, the potential for exploitation within multi-user environments is high.

Analyst Recommendation

Organizations using Coolify in multi-tenant or multi-team environments must apply the provided update immediately. Failure to patch allows for significant unauthorized control over the server and application management lifecycle.

Description Summary:
Coolify is susceptible to OS command injection, allowing authenticated attackers to execute arbitrary system commands via improper neutralization of special elements.

Executive Summary:
A high-severity OS command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary system-level commands, posing a critical risk to server integrity.

Vulnerability Details

CVE-ID: CVE-2026-42204

Affected Software: CoolLabs Coolify

Affected Versions: >= 4.0.0-beta.471, < 4.0.0-beta.474

Vulnerability: This vulnerability is an OS Command Injection (CWE-78) flaw. It requires an authenticated user to provide malicious input that is not properly sanitized, enabling the execution of unauthorized commands on the underlying host operating system.

Business Impact

The exploitation of this flaw allows an attacker to gain full control over the server hosting Coolify. Given the CVSS score of 8.8, this represents a high risk of total system compromise, including unauthorized data access, modification of application databases, and potential lateral movement into the broader network infrastructure.

Remediation Plan

Immediate Action: Update the Coolify instance to version 4.0.0-beta.474 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor system logs for unusual process execution, unexpected shell commands, or unauthorized modifications to critical configuration files.

Compensating Controls: Implement strict network segmentation and ensure the Coolify service runs with the least-privileged user account necessary to limit the impact of potential command execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to execute arbitrary OS commands is a critical security failure. Administrators must prioritize upgrading to version 4.0.0-beta.474 without delay. Failure to patch this vulnerability leaves the underlying server environment exposed to full administrative takeover.

Description Summary:
Coolify contains a path traversal vulnerability that allows authenticated users to access or manipulate restricted files on the server.

Executive Summary:
A path traversal vulnerability in Coolify allows authenticated users to access sensitive files outside of the intended directory, threatening system confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2026-42200

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.474

Vulnerability: This is a Path Traversal (CWE-22) vulnerability that arises from the improper restriction of file paths. Authenticated attackers can supply specially crafted inputs to access directories or files that should be protected, leading to unauthorized read or write access.

Business Impact

The CVSS score of 8.8 indicates a high severity level. Successful exploitation could allow an attacker to read sensitive configuration files, credentials, or system files, leading to privilege escalation or complete system takeover.

Remediation Plan

Immediate Action: Update Coolify to version 4.0.0-beta.474 or newer to incorporate the necessary file path validation fixes.

Proactive Monitoring: Monitor filesystem access logs for attempts to access directories outside of the designated web root or expected application paths.

Compensating Controls: Use file system permissions to restrict the Coolify service account to the absolute minimum set of directories required for its operation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Path traversal vulnerabilities are frequently chained to achieve more severe impact. Administrators are strongly advised to apply the update to version 4.0.0-beta.474 as soon as possible to prevent unauthorized access to the host file system.

Description Summary:
Coolify is vulnerable to an OS command injection flaw, allowing authenticated attackers to execute arbitrary code on the host operating system.

Executive Summary:
A critical OS command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary system commands, resulting in a high risk of total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-42153

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.474

Vulnerability: The application incorrectly handles special characters, which allows an authenticated attacker to inject and execute OS commands. This vulnerability leverages the application's internal functions to interact with the host system unexpectedly.

Business Impact

The CVSS score of 8.8 underscores the severity of this vulnerability, which allows attackers to gain unauthorized control over the server environment. This could result in the compromise of sensitive credentials, data theft, or the use of the server in further malicious activities.

Remediation Plan

Immediate Action: Upgrade to Coolify version 4.0.0-beta.474 or higher to resolve the underlying input validation issues.

Proactive Monitoring: Review application logs for input patterns containing shell metacharacters and monitor for suspicious unauthorized system processes.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common OS command injection patterns in HTTP requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Maintaining an outdated version of Coolify exposes the host environment to significant risk. It is imperative that administrators apply the provided security patch immediately to ensure the security of the application and the host server.

Description Summary:
Coolify is susceptible to an OS Command Injection vulnerability, permitting authenticated users to execute arbitrary commands on the host server.

Executive Summary:
An OS command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary system commands, potentially leading to full server compromise.

Vulnerability Details

CVE-ID: CVE-2026-42143

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: This is an OS Command Injection (CWE-78) vulnerability occurring when the application fails to properly sanitize user-supplied input before passing it to system-level commands. This requires the attacker to have an authenticated session to the Coolify interface.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a high-risk scenario for any organization utilizing Coolify for infrastructure management. Exploitation could result in a full compromise of the application server, enabling the attacker to manipulate managed databases or deploy malicious applications.

Remediation Plan

Immediate Action: Update the Coolify installation to version 4.0.0-beta.471 or higher to patch the command injection vulnerability.

Proactive Monitoring: Monitor system audit logs for unauthorized command execution or unexpected spikes in CPU usage associated with the Coolify service.

Compensating Controls: Implement strict network segmentation to ensure the host system is not directly accessible from untrusted networks, reducing the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Immediate patching is required to secure the environment. Organizations should verify that their instance of Coolify is updated to at least version 4.0.0-beta.471 to ensure this vulnerability is addressed.

Description Summary:
A security vulnerability has been identified in the Coolify platform that may affect the security posture of self-hosted managed environments.

Executive Summary:
Coolify is affected by a high-severity vulnerability that could allow unauthorized actors to compromise the security of managed applications and databases.

Vulnerability Details

CVE-ID: CVE-2026-41896

Affected Software: Coolify Coolify

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability is associated with the Coolify management tool, which facilitates server and database administration. The flaw potentially exposes the management layer to unauthorized manipulation, though specific attack vectors depend on the current deployment configuration.

Business Impact

The CVSS score of 7.5 highlights a significant risk profile. Successful exploitation of this vulnerability could result in unauthorized administrative control over the Coolify interface, leading to the modification of hosted application environments, database compromise, and potential exfiltration of sensitive organizational data.

Remediation Plan

Immediate Action: Verify the version of Coolify in use and apply the latest vendor-supplied patches as soon as they become available.

Proactive Monitoring: Monitor application logs for unauthorized login attempts or unexpected changes to server configuration parameters within the Coolify dashboard.

Compensating Controls: Implement strict firewall rules to ensure the Coolify administration interface is only accessible from trusted, internal network segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given that Coolify serves as a central hub for infrastructure management, vulnerabilities in this software are critical. Organizations are urged to monitor vendor security bulletins closely and apply the necessary updates to prevent unauthorized access to their managed infrastructure.

Description Summary:
Coolify contains an OS command injection vulnerability that allows authenticated users to execute arbitrary system commands via improper input neutralization.

Executive Summary:
An OS command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary system commands, potentially leading to a full host compromise.

Vulnerability Details

CVE-ID: CVE-2026-34599

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: This vulnerability is caused by improper neutralization of special elements within OS commands. It allows a low-privilege authenticated attacker to escape intended command boundaries and execute arbitrary code on the host system.

Business Impact

With a CVSS score of 8.8, this flaw presents a substantial risk to the security of the infrastructure. Unauthorized command execution can lead to data exfiltration, service disruption, and complete loss of control over the self-hosted environment.

Remediation Plan

Immediate Action: Update the Coolify installation to version 4.0.0-beta.471 or later as specified in the vendor's security advisory.

Proactive Monitoring: Monitor the server for unauthorized shell access or unusual child processes spawned by the Coolify service.

Compensating Controls: Implement strict firewall rules to restrict network access to the Coolify administrative interface to trusted users only, reducing the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS severity, immediate patching is required. Administrators should verify their current version and apply the recommended update to mitigate the risk of remote command execution.

Description Summary:
A security vulnerability has been identified in the Coolify platform, an open-source tool used for self-hosting and managing applications and databases.

Executive Summary:
The identified vulnerability in Coolify poses a high-risk security threat, potentially allowing unauthorized administrative control over self-hosted infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-34597

Affected Software: Coolify

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability impacts the functionality of the Coolify management suite. Because Coolify manages critical server and database assets, an exploit could facilitate unauthorized administrative actions within the application environment.

Business Impact

Successful exploitation of this flaw carries a CVSS score of 8.8, reflecting its potential to disrupt business operations and facilitate data exfiltration from managed databases. The impact is significant, as a breach of the management tool grants an attacker broad control over the entire ecosystem hosted on the platform.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates to your Coolify installation as a matter of priority.

Proactive Monitoring: Review logs for unusual administrative activity or unauthorized modifications to application deployment settings.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect incoming traffic for known attack patterns targeting administrative endpoints in the Coolify interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical risk to the security of infrastructure managed by Coolify. It is imperative that security teams apply the latest vendor patches immediately and conduct a thorough audit of their Coolify environments to detect any signs of prior unauthorized access.

Description Summary:
A security vulnerability has been identified in Coolify, an open-source tool for managing servers, applications, and databases.

Executive Summary:
A high-severity security flaw in Coolify could allow unauthorized actors to compromise the management layer of self-hosted server and application environments.

Vulnerability Details

CVE-ID: CVE-2026-34594

Affected Software: Coolify

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the core management functionality of the Coolify platform. As an administrative tool for infrastructure, any flaw here could allow an attacker to gain elevated control over managed servers and databases.

Business Impact

The compromise of a centralized management tool like Coolify can result in total loss of confidentiality, integrity, and availability for all connected downstream applications and databases. With a CVSS score of 8.8, the impact is severe, as it provides a single point of failure for an organization's infrastructure orchestration.

Remediation Plan

Immediate Action: Update the Coolify instance to the latest version released by the vendor to ensure all security patches are applied.

Proactive Monitoring: Monitor Coolify administrative access logs for suspicious login attempts or unauthorized configuration changes.

Compensating Controls: Restrict access to the Coolify management interface to known, trusted IP addresses via a VPN or firewall rule to minimize the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the central role Coolify plays in managing infrastructure, this vulnerability must be treated with extreme urgency. Administrators should apply the necessary updates immediately and audit current configurations to ensure no unauthorized access has already occurred.

Description Summary:
A security vulnerability has been identified in the Coolify self-hosted management platform that may allow for unauthorized system interaction.

Executive Summary:
Coolify is affected by a high-severity vulnerability that poses a significant risk to the integrity and security of managed servers and databases.

Vulnerability Details

CVE-ID: CVE-2026-34592

Affected Software: Coolify Coolify

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects the Coolify management platform, potentially allowing an attacker to manipulate server or application configurations. The specific authentication requirements remain to be clarified by the vendor, though the nature of the tool suggests a risk of unauthorized administrative access.

Business Impact

With a CVSS score of 7.7, this vulnerability is classified as High. Successful exploitation could lead to full system compromise, unauthorized access to sensitive databases, and total loss of availability for hosted applications, causing severe operational disruption and potential data exfiltration.

Remediation Plan

Immediate Action: Identify all instances of Coolify within the environment and apply the latest security patches provided by the vendor immediately.

Proactive Monitoring: Review system access logs and application audit trails for anomalous administrative activity or unauthorized configuration changes.

Compensating Controls: Restrict network access to the Coolify dashboard using IP allowlisting and ensure it is not exposed to the public internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role Coolify plays in managing infrastructure, this vulnerability must be treated with high priority. Organizations should prioritize patching and verify that all administrative interfaces are properly secured against external access to mitigate the risk of compromise.

Description Summary:
Coolify is vulnerable to a Cross-Site Request Forgery (CSRF) attack, which could allow an unauthorized party to perform actions on behalf of an authenticated user.

Executive Summary:
A Cross-Site Request Forgery (CSRF) vulnerability in Coolify could enable attackers to perform unauthorized actions, potentially leading to a full compromise of the application environment.

Vulnerability Details

CVE-ID: CVE-2026-34171

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: This vulnerability is a CSRF (CWE-352) flaw where an attacker can trick an authenticated user into executing unwanted actions within the Coolify interface. This is typically achieved by enticing a user to click a malicious link while they have an active session.

Business Impact

With a CVSS score of 8.0, this vulnerability poses a significant risk to the confidentiality and integrity of the application. An attacker could force administrative actions, such as changing system settings or creating new user accounts, leading to unauthorized access and potential data exfiltration.

Remediation Plan

Immediate Action: Upgrade to Coolify version 4.0.0-beta.471 or later to implement the required CSRF protection mechanisms.

Proactive Monitoring: Review audit logs for unexpected account modifications or changes to application settings that do not align with known administrative activity.

Compensating Controls: Encourage users to log out of the Coolify dashboard when not in use and implement browser-based security policies to mitigate CSRF risks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

CSRF vulnerabilities can be highly damaging in management tools like Coolify. It is essential to update to the patched version immediately to ensure that session integrity is maintained and to prevent unauthorized administrative actions.

Description Summary:
Coolify is vulnerable to OS Command Injection, allowing authenticated users to execute arbitrary commands on the underlying host system.

Executive Summary:
An OS command injection vulnerability in Coolify allows authenticated attackers to achieve remote code execution, posing a severe risk to host infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-34168

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: This vulnerability is an OS Command Injection (CWE-78) flaw that allows an authenticated user with low privileges to inject and execute arbitrary OS commands. The vulnerability exists due to improper neutralization of special elements used in system calls.

Business Impact

Successful exploitation allows an attacker to gain unauthorized control over the server hosting Coolify. Given the high CVSS score of 8.8, this vulnerability could lead to complete system compromise, unauthorized data access, and the potential for lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade Coolify to version 4.0.0-beta.471 or later immediately to resolve the injection flaw.

Proactive Monitoring: Review system logs for suspicious process execution patterns or unexpected shell commands originating from the Coolify service account.

Compensating Controls: Ensure the Coolify service is running with the least privilege necessary on the host OS to limit the impact of potential command execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a significant risk to the integrity and confidentiality of the host environment. Administrators should prioritize patching to version 4.0.0-beta.471 immediately to mitigate the risk of remote code execution.

Description Summary:
Coolify is vulnerable to OS Command Injection, allowing an authenticated user to execute arbitrary commands on the underlying host system.

Executive Summary:
An OS command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary system commands, posing a high risk to server integrity and data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-34158

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.469

Vulnerability: This vulnerability is an OS Command Injection (CWE-78) flaw that permits an authenticated user with low-level privileges to inject malicious commands into the host operating system. The vulnerability stems from improper neutralization of special elements used in system calls.

Business Impact

The ability to execute arbitrary OS commands provides an attacker with a foothold on the server, potentially leading to full system compromise. With a CVSS score of 8.8, this high-severity vulnerability could result in unauthorized data exfiltration, service disruption, and the deployment of persistent malware within the infrastructure.

Remediation Plan

Immediate Action: Upgrade Coolify to version 4.0.0-beta.469 or later to incorporate the necessary security patches.

Proactive Monitoring: Review system and application logs for unexpected shell process executions or irregular administrative activity.

Compensating Controls: Implement strict network segmentation and restrict access to the management interface to trusted IP addresses to limit the potential attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score of 8.8, this vulnerability represents a significant risk to the security of the host environment. Organizations should prioritize updating their Coolify instances to the latest available version immediately to remediate the command injection vector and prevent potential unauthorized remote code execution.

Description Summary:
Coolify is susceptible to an OS Command Injection vulnerability, allowing authenticated attackers to execute arbitrary system commands on the host server.

Executive Summary:
An OS command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary code on the underlying host, posing a significant risk to the entire self-hosted environment.

Vulnerability Details

CVE-ID: CVE-2026-34153

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: The application fails to properly neutralize special elements used in an OS command, enabling an authenticated user to perform OS command injection. This vulnerability requires a low-privilege authenticated session to initiate the attack.

Business Impact

Successful exploitation of this vulnerability grants an attacker the ability to execute commands with the privileges of the Coolify application. Given the CVSS score of 8.8, this poses a high risk of full system compromise, unauthorized data access, and potential lateral movement into other databases or services managed by the platform.

Remediation Plan

Immediate Action: Upgrade Coolify to version 4.0.0-beta.471 or later to implement the necessary input neutralization patches.

Proactive Monitoring: Review system and application access logs for unusual command executions or unexpected process spawning originating from the Coolify service account.

Compensating Controls: Ensure the Coolify instance is running in an isolated container with minimal host-level permissions to limit the impact of a potential container escape or code execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical security risk to the integrity of the host server. Administrators are urged to prioritize the update to the latest version immediately to eliminate the command injection vector.

Description Summary:
Coolify is vulnerable to OS Command Injection, enabling authenticated attackers to execute arbitrary system commands through insecure input handling.

Executive Summary:
An authenticated OS Command Injection vulnerability in Coolify allows for remote code execution, threatening the integrity of the host environment.

Vulnerability Details

CVE-ID: CVE-2026-34152

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: This vulnerability (CWE-78) occurs due to the improper neutralization of special characters in input fields, allowing an authenticated attacker to inject and execute OS-level commands. This effectively bypasses the application's intended functional boundaries.

Business Impact

The ability to execute OS commands on the host server provides an attacker with broad capabilities, including data theft, privilege escalation, and persistent backdooring of the environment. The CVSS score of 8.8 highlights the high risk associated with this vulnerability, requiring prompt remediation to prevent unauthorized access to critical infrastructure.

Remediation Plan

Immediate Action: Apply the vendor-provided update to version 4.0.0-beta.471 or later to remediate the command injection flaw.

Proactive Monitoring: Regularly audit server access logs and monitor for unexpected command execution or child processes being spawned by the application.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common shell injection patterns in request parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant security risk for Coolify users. Administrators are strongly advised to perform the update to version 4.0.0-beta.471 across all environments to ensure protection against potential exploitation.

Description Summary:
Coolify contains an OS Command Injection vulnerability allowing authenticated attackers to execute arbitrary commands on the host system via improper input neutralization.

Executive Summary:
An authenticated OS Command Injection vulnerability in Coolify permits remote code execution, posing a critical risk to host server security.

Vulnerability Details

CVE-ID: CVE-2026-34058

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: This flaw is classified as CWE-78, where the application fails to properly sanitize user-supplied input before passing it to a system shell. Authenticated users can leverage this weakness to execute arbitrary OS commands, bypassing intended application restrictions.

Business Impact

An attacker exploiting this vulnerability could gain unauthorized control over the server, potentially leading to the compromise of hosted databases and application data. With a CVSS score of 8.8, the potential for full system takeover makes this an urgent security concern for organizations relying on Coolify for infrastructure management.

Remediation Plan

Immediate Action: Update the Coolify installation to version 4.0.0-beta.471 or higher to patch the command injection vulnerability.

Proactive Monitoring: Monitor system logs for unusual shell activity or unauthorized process spawning associated with the Coolify service.

Compensating Controls: Implement strict network segmentation and egress filtering to prevent the application from making unauthorized outbound connections if the server is compromised.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS severity, failure to remediate this vulnerability exposes the entire server environment to potential takeover. Organizations must treat this as a high-priority update and apply the patch to all affected instances immediately.

Description Summary:
Coolify is susceptible to an OS Command Injection vulnerability that allows authenticated attackers to execute arbitrary system commands on the host server.

Executive Summary:
A critical OS Command Injection vulnerability in Coolify allows authenticated attackers to achieve remote code execution on the underlying host system.

Vulnerability Details

CVE-ID: CVE-2026-34057

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: This vulnerability involves improper neutralization of special elements used in an OS command (CWE-78). An attacker with low-level authenticated access can manipulate input parameters to execute arbitrary commands with the privileges of the Coolify application.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the host environment. An attacker achieving remote code execution could gain full control over the server, leading to data exfiltration, lateral movement within the network, or total system compromise. Given the CVSS score of 8.8, this represents a high-severity threat that requires immediate attention.

Remediation Plan

Immediate Action: Upgrade to Coolify version 4.0.0-beta.471 or later immediately to resolve the vulnerable code path.

Proactive Monitoring: Review application and system audit logs for suspicious process execution patterns or unexpected command-line arguments originating from the Coolify service account.

Compensating Controls: Ensure the Coolify application runs with the principle of least privilege, utilizing containerization or restricted service accounts to limit the impact of potential command execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The presence of an OS command injection vulnerability in a self-hosted management tool is highly dangerous. Administrators should prioritize upgrading their Coolify instances to version 4.0.0-beta.471 immediately to mitigate the risk of unauthorized system-level access.

Description Summary:
Coolify terminal WebSocket routes fail to enforce team-based authorization, enabling low-privileged team members to execute commands on servers belonging to other teams.

Executive Summary:
A critical missing authorization flaw in Coolify allows low-privileged users to execute commands on unauthorized servers, creating a high risk of cross-team privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-34048

Affected Software: Coollabsio Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: The vulnerability exists because terminal WebSocket bootstrap routes only verify general authentication rather than specific team-based authorization. This allows a low-privileged user to establish terminal connections to resources they are not permitted to access, facilitating unauthorized command execution.

Business Impact

With a CVSS score of 9.9, this vulnerability carries severe business risk, including the potential for cross-team data compromise and unauthorized infrastructure manipulation. If exploited, a malicious insider or compromised low-privileged account could gain control over servers they are not authorized to manage, leading to significant security breaches and operational disruption.

Remediation Plan

Immediate Action: Update Coolify to version 4.0.0-beta.471 or later to enforce mandatory terminal authorization checks.

Proactive Monitoring: Monitor logs for unauthorized terminal connection attempts or unexpected shell activity initiated by low-privileged user accounts.

Compensating Controls: Implement strict network-level segmentation to isolate team environments, reducing the ability for cross-resource terminal connections if the application layer is compromised.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The missing authorization control in Coolify presents an urgent security risk that must be addressed. Administrators should deploy the provided update immediately to ensure that terminal access is correctly gated by team permissions and to prevent unauthorized command execution across the server fleet.

Description Summary:
Coolify terminal WebSocket routes fail to enforce authorization, allowing authenticated users to access and execute commands on unauthorized resources.

Executive Summary:
A critical authorization vulnerability in Coolify allows authenticated users to bypass scope restrictions and execute arbitrary commands, posing a severe risk of unauthorized system control.

Vulnerability Details

CVE-ID: CVE-2026-34047

Affected Software: Coollabsio Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: This vulnerability involves an improper authorization flaw where terminal WebSocket bootstrap routes fail to validate user permissions. An authenticated user can leverage this to access terminal functionality for resources outside their authorized scope, potentially leading to arbitrary command execution.

Business Impact

The impact of this vulnerability is critical, as it allows for unauthorized lateral movement and command execution within the infrastructure managed by Coolify. Given the CVSS score of 9.9, the potential for total system compromise is extremely high, which could lead to data exfiltration, service disruption, and complete loss of integrity for the managed applications and databases.

Remediation Plan

Immediate Action: Upgrade Coolify to version 4.0.0-beta.471 or later immediately to apply the necessary authorization middleware fixes.

Proactive Monitoring: Review system and application access logs for unusual terminal session activity or commands executed by users outside of their assigned project scopes.

Compensating Controls: If immediate patching is not possible, restrict network access to the Coolify administrative interface to trusted management subnets only to limit the attack surface.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant security risk due to the potential for unauthorized command execution across managed environments. Organizations should prioritize upgrading to version 4.0.0-beta.471 as soon as possible to ensure proper authorization enforcement and prevent unauthorized access to critical infrastructure.

Description Summary:
Coolify is affected by an authorization bypass vulnerability, allowing authenticated users to access resources they are not permitted to view via user-controlled keys.

Executive Summary:
An authorization bypass vulnerability in Coolify allows authenticated users to access sensitive data outside their scope, posing a significant risk to internal data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-34044

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.466

Vulnerability: This flaw involves an Authorization Bypass Through User-Controlled Key (CWE-639). An authenticated user can manipulate identifiers to access resources or data belonging to other users or system areas they are not authorized to interact with.

Business Impact

The CVSS score of 7.7 reflects a high risk of unauthorized information disclosure. By bypassing authorization controls, an attacker can access sensitive environment configurations, database credentials, or other critical data, leading to severe reputational and security consequences for the organization.

Remediation Plan

Immediate Action: Upgrade to Coolify version 4.0.0-beta.466 or later to enforce proper authorization checks.

Proactive Monitoring: Analyze application access logs for patterns of unusual resource requests, particularly those involving sequential IDs or out-of-bounds object access.

Compensating Controls: Use a Web Application Firewall (WAF) to filter and inspect requests for suspicious parameter manipulation if an immediate update is not feasible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Authorization bypass flaws undermine the fundamental security model of any multi-user application. Administrators must apply the vendor-provided security update to version 4.0.0-beta.466 to ensure that resource access control policies are correctly enforced and data privacy is restored.

Description Summary:
Coolify contains an authenticated remote command injection vulnerability in application deployment handling, allowing remote code execution and sensitive data exfiltration.

Executive Summary:
An authenticated remote code execution vulnerability in Coolify allows attackers with application write permissions to compromise host environments and exfiltrate sensitive configuration data.

Vulnerability Details

CVE-ID: CVE-2026-34038

Affected Software: Coollabsio Coolify

Affected Versions: < 4.0.0-beta.469

Vulnerability: This is an OS command injection vulnerability triggered via application deployment fields like dockerfile_location and deployment commands. An attacker must possess authenticated application write permissions to exploit the flaw.

Business Impact

The vulnerability carries a CVSS score of 9.9, reflecting its ability to grant full system control to an attacker. Successful exploitation allows for the exfiltration of environment variables, which often contain database credentials, API keys, and other sensitive infrastructure secrets, leading to a complete compromise of the hosted application stack.

Remediation Plan

Immediate Action: Upgrade Coolify to version 4.0.0-beta.469 or later immediately to patch the command injection vulnerability.

Proactive Monitoring: Review deployment logs and audit application configuration changes for suspicious entries within the dockerfile_location or deployment command fields.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) to limit the number of users with application write permissions until the patch is applied.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Jul 6, 2026, a public proof-of-concept exploit is available. Given the availability of exploit code, the risk of active exploitation is significant.

Analyst Recommendation

The presence of a public exploit combined with the high CVSS score makes this a critical priority. Administrators must prioritize updating to version 4.0.0-beta.469 to prevent potential full-system compromise and data theft.

Description Summary:
An authorization bypass vulnerability in Coolify allows authenticated users to access and manipulate resources belonging to other tenants.

Executive Summary:
An authorization flaw in Coolify allows authenticated users to bypass tenant isolation and clone resources into unauthorized cross-tenant environments.

Vulnerability Details

CVE-ID: CVE-2026-34037

Affected Software: coollabsio coolify

Affected Versions: < 4.0.0-beta.464

Vulnerability: The vulnerability exists in the cloneTo() Livewire action, which performs unscoped Eloquent lookups for destination resources. An authenticated user can leverage this to clone resources into destinations owned by other teams, effectively bypassing cross-tenant access controls.

Business Impact

This flaw breaks the fundamental multi-tenancy isolation of the Coolify platform. An attacker could gain unauthorized access to sensitive application or database configurations, leading to cross-tenant data exposure and potential privilege escalation within the management console. With a CVSS score of 9.9, this vulnerability represents a severe breach of trust and data integrity for any organization managing multiple teams or clients on a single instance.

Remediation Plan

Immediate Action: Upgrade Coolify to version 4.0.0-beta.464 or later to enforce proper scoping in resource operations.

Proactive Monitoring: Audit recent resource cloning activities and team access logs to identify any unauthorized cross-tenant resource movement.

Compensating Controls: Limit access to the Coolify management interface to trusted users only and implement strict internal network access controls until the patch is applied.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high impact on data confidentiality and integrity, administrators should update their Coolify instance immediately. Following the update, an audit of current resource permissions is recommended to ensure no unauthorized cross-tenant actions occurred prior to the fix.

Description Summary:
Coolify is susceptible to an OS command injection vulnerability, enabling authenticated users to perform unauthorized command execution on the host machine.

Executive Summary:
An OS command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary system commands, posing a substantial risk to the confidentiality and integrity of the system.

Vulnerability Details

CVE-ID: CVE-2026-34035

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.466

Vulnerability: This vulnerability is classified as an OS Command Injection (CWE-78) occurring when the application fails to properly validate user-supplied input before passing it to system-level commands. Authenticated users can exploit this to achieve unauthorized code execution.

Business Impact

With a CVSS score of 8.8, the vulnerability presents a high risk of total system compromise. Successful exploitation could result in the breach of sensitive data, disruption of critical business services, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade to Coolify version 4.0.0-beta.466 or newer immediately.

Proactive Monitoring: Review logs for unusual system calls and monitor for unauthorized changes to system configurations or files.

Compensating Controls: Restrict administrative access to the Coolify dashboard using multi-factor authentication and IP allowlisting to mitigate the risk of unauthorized exploitation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of command injection flaws, immediate patching is necessary to secure the environment. Ensure that all affected Coolify instances are updated to the specified version to neutralize this high-severity threat.

Description Summary:
Coolify contains an OS command injection vulnerability that allows an authenticated user to execute arbitrary commands on the host server.

Executive Summary:
An OS command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary system commands, leading to potential full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-34034

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.466

Vulnerability: This is an OS Command Injection vulnerability (CWE-78) triggered by the improper sanitization of inputs processed by the application. An authenticated user can leverage this flaw to run unauthorized commands on the underlying operating system.

Business Impact

A CVSS score of 8.8 underscores the severity of this issue, as it allows attackers to bypass security controls and gain unauthorized access to the host server. This could lead to severe consequences, including data theft, manipulation of hosted databases, or the total loss of server availability.

Remediation Plan

Immediate Action: Update Coolify to version 4.0.0-beta.466 or later to apply the security fix.

Proactive Monitoring: Continuously audit access logs for suspicious command patterns and monitor server performance for unauthorized background processes.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common shell injection signatures.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The risk posed by this OS command injection is severe and requires prompt attention. Security teams must ensure all Coolify deployments are patched to the fixed version to prevent authenticated actors from escalating their privileges to the OS level.

Description Summary:
A high-severity vulnerability has been identified in the Coolify self-hosted server and application management platform.

Executive Summary:
A critical security vulnerability in the Coolify management platform poses a high risk of unauthorized system control and potential data compromise.

Vulnerability Details

CVE-ID: CVE-2026-27957

Affected Software: Coolify Coolify

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the Coolify platform, which is designed for managing servers, applications, and databases. The nature of the flaw allows for potential unauthorized actions that could compromise the integrity of the entire managed environment.

Business Impact

Because Coolify is used to manage critical server infrastructure and databases, a successful exploit could grant an attacker full control over the underlying assets. The CVSS score of 8.8 highlights the severity of this risk, which could result in complete system takeover, data exfiltration, and significant operational downtime for all services managed by the Coolify instance.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the Coolify project immediately to mitigate risks of unauthorized access.

Proactive Monitoring: Monitor server and database logs for unauthorized configuration changes or unexpected administrative sessions initiated from unknown IP addresses.

Compensating Controls: Isolate the Coolify management instance within a secure network segment and restrict access to authorized personnel via secure administrative gateways.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators must treat this vulnerability with the highest priority, as Coolify serves as a central point of control for multiple infrastructure components. Immediate patching is required to prevent potential lateral movement and full-scale compromise of the managed server environment.

Description Summary:
A credential exposure vulnerability in Coolify allows low-privileged users to access the root SSH private key, leading to full system compromise.

Executive Summary:
A critical credential exposure vulnerability in Coolify allows authenticated users to obtain the root SSH private key, enabling full remote command execution and unauthorized server access.

Vulnerability Details

CVE-ID: CVE-2025-64420

Affected Software: Coolify

Affected Versions: <= 4.0.0-beta.434

Vulnerability: This flaw involves insufficient protection of sensitive credentials, where a low-privileged user can retrieve the root user's private SSH key. Access to this key grants the attacker the ability to authenticate as the root user on the underlying host server.

Business Impact

The potential impact of this vulnerability is total system compromise, allowing an attacker to gain full control over the server environment. Given the CVSS score of 9.9, this represents a critical risk that could lead to complete data theft, unauthorized modification of hosted applications, and total loss of confidentiality, integrity, and availability for the affected infrastructure.

Remediation Plan

Immediate Action: Upgrade to a version of Coolify beyond 4.0.0-beta.434 immediately to resolve the credential exposure. If an update is not immediately feasible, revoke all existing SSH keys and rotate credentials to prevent potential misuse.

Proactive Monitoring: Review system access logs for anomalous SSH logins and monitor for unauthorized attempts to access configuration files or sensitive credential storage paths within the Coolify instance.

Compensating Controls: Implement strict network segmentation and egress filtering to limit the reach of an attacker should they successfully access the server via SSH. Ensure that the Coolify instance is not exposed to the public internet without additional layers of authentication or VPN access.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While there is no current evidence of a weaponized exploit, the nature of the flaw, which provides direct access to root credentials, poses an extreme risk regardless of current exploit availability.

Analyst Recommendation

This is a critical vulnerability that requires immediate attention and remediation. Because the flaw grants an attacker full root access to the underlying server, administrators should prioritize patching to the latest version as soon as possible and conduct a thorough audit of their server security posture to ensure no unauthorized keys have already been added or leveraged.

Description Summary:
Coolify is vulnerable to command injection via unsanitized docker-compose.yaml parameters, allowing unauthenticated attackers to execute commands as root if a user deploys a malicious repository.

Executive Summary:
Coolify versions prior to 4.0.0-beta.445 are vulnerable to a critical command injection flaw that allows remote attackers to execute arbitrary commands with root privileges.

Vulnerability Details

CVE-ID: CVE-2025-64419

Affected Software: Coolify

Affected Versions: < 4.0.0-beta.445

Vulnerability: This vulnerability is a command injection flaw (CWE-77) where parameters in a docker-compose.yaml file are not properly sanitized before being passed to system commands. An attacker can leverage this by convincing a user to deploy an application from a malicious repository, resulting in unauthenticated command execution with root-level privileges on the host instance.

Business Impact

The potential for full system compromise, including unauthorized data access and total loss of server control, makes this a critical security event. With a CVSS score of 9.6, the vulnerability represents an extreme risk to the confidentiality, integrity, and availability of the entire Coolify environment and any hosted databases or applications.

Remediation Plan

Immediate Action: Upgrade Coolify to version 4.0.0-beta.445 or later immediately to apply the necessary input sanitization patches.

Proactive Monitoring: Review server logs for unusual command execution patterns or unauthorized repository deployment activities.

Compensating Controls: Ensure that the Coolify instance is deployed in an isolated network segment and restrict the ability to import repositories from untrusted or external sources.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of January 5, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly dangerous because it facilitates root-level access through a common administrative workflow.

Analyst Recommendation

Given the critical severity and the potential for complete system takeover, organizations must prioritize patching this vulnerability. Administrators should verify their current version and update to 4.0.0-beta.445 without delay to prevent exploitation of this command injection vector.

Description Summary:
Coolify is vulnerable to OS command injection in the Git Repository field during project creation, allowing authenticated users to execute arbitrary commands on the host server.

Executive Summary:
A critical OS command injection vulnerability in Coolify allows authenticated users to achieve remote code execution on the underlying server.

Vulnerability Details

CVE-ID: CVE-2025-59157

Affected Software: Coolify Coolify

Affected Versions: < 4.0.0-beta.420.7

Vulnerability: This vulnerability is an OS command injection flaw (CWE-78) triggered via the Git Repository input field during project creation. The issue exists because user input is not properly sanitized, allowing any authenticated member user to inject and execute arbitrary shell commands.

Business Impact

The ability for an authenticated user to execute arbitrary shell commands on the host server represents a total compromise of the application environment. This could lead to unauthorized access to sensitive database credentials, full data exfiltration, or the complete takeover of the server infrastructure. With a CVSS score of 9.9, this vulnerability poses a severe risk to the confidentiality, integrity, and availability of all hosted applications.

Remediation Plan

Immediate Action: Upgrade Coolify to version 4.0.0-beta.420.7 or later to implement the required input sanitization patch.

Proactive Monitoring: Review application and system access logs for unusual command executions or unexpected modifications to project deployment configurations.

Compensating Controls: Restrict access to the project creation functionality to trusted users only and implement strict network segmentation to limit the impact of a potential server compromise.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 5, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly dangerous because it facilitates direct interaction with the host operating system from the application interface.

Analyst Recommendation

Given the critical CVSS severity and the ease of exploitation by authenticated users, immediate patching is mandatory. Organizations should prioritize updating their Coolify instances to version 4.0.0-beta.420.7 to remediate this command injection flaw and prevent potential unauthorized remote code execution.