Executive brief
Coolify, an open-source tool used to manage servers and databases, contains a security flaw that allows authorized users to take full control of managed servers. By providing a specially crafted network name, a user with basic management permissions can execute commands with administrative (root) privileges. This could lead to the theft of sensitive data, access to all managed applications, and complete compromise of the server infrastructure.
Technical details
An OS command injection vulnerability (CWE-78) exists in Coolify's Destination Network Management component within 'app/Livewire/Destination/Show.php'. The 'network' parameter is captured via Livewire input and subsequently interpolated directly into shell commands (e.g., 'docker network rm') without proper sanitization or validation. An authenticated attacker with destination management permissions can exploit this by supplying a malicious payload in the network name field. Upon triggering a destination deletion, the payload executes with root privileges on the managed server. The issue is resolved in version 4.0.0-beta.471.
Affected products
- coollabsio Coolify < 4.0.0-beta.471
Timeline
- 2026-06-25: advisory: GitHub Security Advisory published by vendor
- 2026-06-29: disclosed: CVE published to NVD
- 2026-06-25: patched: Fixed in version 4.0.0-beta.471