A critical command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary code on the underlying host server by manipulating environment variable keys.

This is an OS command injection vulnerability (CWE-78) occurring because the application fails to properly escape environment variable key names before passing them to Docker commands executed over SSH. An authenticated attacker can inject shell metacharacters into these keys to escape the intended context and execute commands on the host operating system.

Successful exploitation grants an attacker full control over the host server running the Coolify instance, which may lead to total system compromise, data exfiltration, and lateral movement within the network. Given the CVSS score of 8.8, this vulnerability represents a high risk to organizational security and infrastructure integrity. The ability to execute commands outside of containers effectively bypasses the containerization security boundary, rendering the host environment vulnerable.

Immediate Action: Update the Coolify installation to version 4.2.0 or later immediately to apply the necessary input validation fixes.

Proactive Monitoring: Review server access logs and Docker command execution logs for any anomalous shell command patterns or unexpected environment variable configurations.

Compensating Controls: Restrict access to the Coolify management interface to authorized personnel only via network-level controls, and ensure the service is running with the least privilege necessary on the host.

Public Exploit Available: Unknown

The severity of this vulnerability, combined with its ability to facilitate remote code execution on the host, necessitates immediate attention. Administrators must prioritize updating to version 4.2.0 to eliminate the injection vector. Failure to patch this vulnerability leaves the host server exposed to full system takeover by any authenticated user.