Executive brief
Coolify is an open-source platform used to manage and deploy servers, applications, and databases. A security flaw allows an authorized user to execute malicious commands on the underlying server by entering specially crafted text into the Sentinel monitoring settings. This could lead to a complete takeover of the server, unauthorized access to hosted data, and disruption of all managed services.
Technical details
An OS command injection vulnerability (CWE-78) exists in Coolify's Sentinel monitoring component. The root cause is the improper neutralization of the 'sentinel_token' variable, which is directly interpolated into shell commands within 'app/Actions/Server/StartSentinel.php' and other components during Docker startup and metrics collection. An authenticated attacker with access to server settings can provide a malicious token containing shell metacharacters (e.g., quotes and semicolons). When the Sentinel service is automatically restarted or metrics are requested, the injected commands are executed on the host with the privileges of the Coolify process. This issue is resolved in version 4.0.0-beta.466 by implementing strict token validation.
Affected products
- coollabsio Coolify < 4.0.0-beta.466
Timeline
- 2026-03-04: disclosed: Vulnerability discovered by Xyptonize
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-07: patched: CVE published and fix confirmed in version 4.0.0-beta.466