Executive brief
Coolify, an open-source tool used to manage servers and applications, contains a vulnerability that allows authenticated team members to execute unauthorized commands on the host server. By including special characters in configuration fields like Docker Compose build or start commands, a malicious user could gain full control over the underlying infrastructure. This could lead to total data loss, service disruption, or unauthorized access to sensitive server resources.
Technical details
An OS command injection vulnerability (CWE-78) exists in Coolify due to a regression in the 'SHELL_SAFE_COMMAND_PATTERN' validation logic. The flaw allows the use of ampersands (&) and other shell operators in custom Docker Compose build, start, and pre/post-deployment command fields. An authenticated attacker with team member privileges can use these operators to break out of the intended command context and execute arbitrary shell commands on the host system. The vulnerability is reachable via the web UI or API. The issue was addressed by refactoring the validation logic to use a token-aware parser that properly handles shell operators and balanced quotes. A fix is available in version 4.0.0-beta.474.
Affected products
- coollabsio Coolify 4.0.0-beta.471 through 4.0.0-beta.473
Timeline
- 2026-04-20: patched: Fix committed to repository via PR #9684.
- 2026-04-21: advisory: Version 4.0.0-beta.474 released.
- 2026-07-06: disclosed: CVE-2026-42204 published.