Is CVE-2026-42204 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42204 being exploited in the wild.

How severe is CVE-2026-42204?

High severity, with a CVSS score of 8.8, published 6 July 2026.

Which products and versions are affected?

coollabsio Coolify 4.0.0-beta.471 through 4.0.0-beta.473.

Is there a fix for CVE-2026-42204?

A patch was published on 2026-04-20: Fix committed to repository via PR #9684. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42204 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-42204?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42204: Coolify OS command injection in Docker Compose command fields

CVE-2026-42204 · Severity: high · CVSS 8.8 · Published 2026-07-06

Coolify, an open-source tool used to manage servers and applications, contains a vulnerability that allows authenticated team members to execute unauthorized commands on the host server. By including special characters in configuration fields like Docker Compose build or start commands, a malicious user could gain full control over the underlying infrastructure. This could lead to total data loss, service disruption, or unauthorized access to sensitive server resources.

Quick answers

Is CVE-2026-42204 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42204 being exploited in the wild.
How severe is CVE-2026-42204?: High severity, with a CVSS score of 8.8, published 6 July 2026.
Which products and versions are affected?: coollabsio Coolify 4.0.0-beta.471 through 4.0.0-beta.473.
Is there a fix for CVE-2026-42204?: A patch was published on 2026-04-20: Fix committed to repository via PR #9684. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42204 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42204?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists in Coolify due to a regression in the 'SHELL_SAFE_COMMAND_PATTERN' validation logic. The flaw allows the use of ampersands (&) and other shell operators in custom Docker Compose build, start, and pre/post-deployment command fields. An authenticated attacker with team member privileges can use these operators to break out of the intended command context and execute arbitrary shell commands on the host system. The vulnerability is reachable via the web UI or API. The issue was addressed by refactoring the validation logic to use a token-aware parser that properly handles shell operators and balanced quotes. A fix is available in version 4.0.0-beta.474.

Affected products

coollabsio Coolify 4.0.0-beta.471 through 4.0.0-beta.473

Timeline

2026-04-20: patched: Fix committed to repository via PR #9684.
2026-04-21: advisory: Version 4.0.0-beta.474 released.
2026-07-06: disclosed: CVE-2026-42204 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.