Executive brief
Coolify is an open-source platform used to manage and automate the deployment of servers, applications, and databases. A security flaw was found where the system failed to properly verify if a user had permission to access the server terminal. This allows a low-privileged team member to bypass restrictions and execute arbitrary commands with administrative (root) privileges on managed servers, potentially leading to full system takeover, data theft, or service disruption.
Technical details
A missing authorization check exists in the terminal websocket bootstrap routes (`POST /terminal/auth` and `POST /terminal/auth/ips`). While the main terminal UI is protected by the `can.access.terminal` middleware, these specific backend routes only verified that a user was authenticated, not that they had terminal permissions. An attacker with low-privileged 'member' access can obtain server and SSH key UUIDs from other application pages, then directly call the bootstrap routes to establish a websocket connection. Because the backend trusts attacker-controlled SSH command strings, the attacker can execute arbitrary shell commands (often as root) on any terminal-enabled server managed by the team. This has been patched in version 4.0.0-beta.471 by applying the appropriate authorization middleware to the affected routes.
Affected products
- coollabsio Coolify < 4.0.0-beta.471
Timeline
- 2026-04-09: patched: Version 4.0.0-beta.471 released
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-07: disclosed: CVE published to NVD