Executive brief
Coolify, an open-source tool for managing servers and databases, contains a security flaw that allows low-privileged users to take full control of managed servers. By exploiting a weakness in how the system handles log requests, an attacker with basic team access can execute arbitrary commands with root-level permissions. This could lead to complete data theft, service disruption, or the compromise of all applications managed by the platform.
Technical details
An OS command injection vulnerability exists in the GetLogs Livewire component of Coolify due to improper neutralization of special elements. The `$container` public property is interpolated directly into shell commands (such as `docker logs` and `docker service logs`) without sanitization. Because the property lacks the `#[Locked]` attribute, it can be modified by any authenticated client via the Livewire wire protocol. An attacker with 'team membership' (the lowest privilege role) can exploit this to execute arbitrary commands as root on the host or managed servers. The issue is resolved in version 4.0.0-beta.471 by adding `#[Locked]` attributes to sensitive properties and implementing container name validation.
Affected products
- coollabsio Coolify < 4.0.0-beta.471
Timeline
- 2026-03-29: patched: Fix committed to repository
- 2026-04-09: advisory: Release v4.0.0-beta.471 published
- 2026-07-06: disclosed: CVE published to NVD