Executive brief
Coolify, an open-source tool for managing servers and databases, was found to have a security flaw in how it handles database credentials. An attacker with high-level administrative access could potentially use specially crafted database usernames or passwords to execute unauthorized commands on the underlying server. This could lead to limited data exposure or unauthorized changes to the system configuration.
Technical details
Coolify prior to version 4.0.0-beta.474 contains an OS command injection vulnerability (CWE-78) within its database management components. Database credential fields, including redis_password, postgres_user, and mysql_user, were validated only as generic strings at the API layer without shell-safety checks. These values were subsequently interpolated directly into Docker Compose YAML command strings and shell commands (such as SSL chown operations) without escaping. An authenticated attacker with high privileges can exploit this by providing malicious strings as credentials to execute arbitrary commands in the context of the host or container. The issue was addressed by implementing strict regex validation patterns and using functions like json_encode and escapeshellarg to sanitize inputs.
Affected products
- coollabsio Coolify < 4.0.0-beta.474
Timeline
- 2026-04-20: patched: Fix committed to repository
- 2026-04-21: advisory: Release v4.0.0-beta.474 published
- 2026-07-07: disclosed: CVE-2026-42201 published