Executive brief
Coolify, an open-source tool used to manage servers and application deployments, is vulnerable to a security flaw that allows authenticated users to execute unauthorized commands. By including specific characters in deployment settings, a user could bypass security filters and run arbitrary code on the remote servers being managed. This could lead to a complete takeover of the connected infrastructure and exposure of sensitive application data.
Technical details
A command injection vulnerability exists in Coolify prior to version 4.0.0-beta.471. While pre-deployment and post-deployment commands were single-quote escaped, they were subsequently transmitted via an SSH heredoc transport that preserves newlines. An authenticated attacker can exploit this by injecting newline characters followed by additional shell commands, which bypass the escaping and execute on the remote target server during the deployment process. The fix involves normalizing whitespace and validating these command fields to prevent newline-based injection.
Affected products
- coollabsio Coolify < 4.0.0-beta.471
Timeline
- 2026-03-25: patched: Fix committed to repository
- 2026-04-09: advisory: Release v4.0.0-beta.471 published
- 2026-07-07: disclosed: CVE published to NVD