CVE-2026-42201: Coolify OS command injection in database credential fields

CVE-2026-42201 · Severity: low · CVSS 3.3 · Published 2026-07-07

Coolify, an open-source tool for managing servers and databases, was found to have a security flaw in how it handles database credentials. An attacker with high-level administrative access could potentially use specially crafted database usernames or passwords to execute unauthorized commands on the underlying server. This could lead to limited data exposure or unauthorized changes to the system configuration.

Quick answers

Is CVE-2026-42201 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42201 being exploited in the wild.
How severe is CVE-2026-42201?
Low severity, with a CVSS score of 3.3, published 7 July 2026.
Which products and versions are affected?
coollabsio Coolify < 4.0.0-beta.474.
Is there a fix for CVE-2026-42201?
A patch was published on 2026-04-20: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42201 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42201?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Coolify prior to version 4.0.0-beta.474 contains an OS command injection vulnerability (CWE-78) within its database management components. Database credential fields, including redis_password, postgres_user, and mysql_user, were validated only as generic strings at the API layer without shell-safety checks. These values were subsequently interpolated directly into Docker Compose YAML command strings and shell commands (such as SSL chown operations) without escaping. An authenticated attacker with high privileges can exploit this by providing malicious strings as credentials to execute arbitrary commands in the context of the host or container. The issue was addressed by implementing strict regex validation patterns and using functions like json_encode and escapeshellarg to sanitize inputs.

Affected products

  • coollabsio Coolify < 4.0.0-beta.474

Timeline

  • 2026-04-20: patched: Fix committed to repository
  • 2026-04-21: advisory: Release v4.0.0-beta.474 published
  • 2026-07-07: disclosed: CVE-2026-42201 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.