CVE-2026-12815: OS Command Injection in Coolify 4.0.0 Image Name Handler

Technical summary

CVE-2026-12815 is an OS command injection vulnerability in the Image Name Handler of Coolify 4.0.0. The vulnerability stems from insufficient input validation in a handler that processes image names, allowing authenticated attackers to embed shell metacharacters and commands. The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command) and CWE-78 (Improper Neutralization of Special Elements used in an OS Command), indicating both generic command and OS-specific command injection risks. The attack requires authentication but no additional user interaction, making it accessible to any user with platform access.

Business impact

For organizations running Coolify for containerized application deployment, this vulnerability represents a critical control plane risk. An authenticated attacker—whether a disgruntled employee or compromised account—could execute arbitrary system commands, leading to lateral movement within infrastructure, data exfiltration, container escape, or disruption of all managed deployments. In multi-tenant or shared Coolify environments, the blast radius extends to all applications and services orchestrated by the platform.

Affected systems

Coolify version 4.0.0 is confirmed vulnerable. The vendor's changelog for version 4.1.2 explicitly mentions improved input validation for image, branch, proxy, and deployment parameters, strongly suggesting this version addresses the identified flaw. Organizations using intermediate versions between 4.0.0 and 4.1.2 should verify their specific version against the vendor's release notes or advisory for guidance on applicability.

Exploitability

Exploitation requires valid authentication credentials to access Coolify, which limits the immediate attack surface compared to unauthenticated vulnerabilities. However, the low complexity attack vector and absence of any required user interaction once authenticated make this straightforward to exploit by insiders or attackers who have obtained valid credentials through other means (phishing, credential stuffing, compromised CI/CD pipelines). This is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation is not yet widespread, but the 6.3 MEDIUM CVSS score reflects the combination of authentication requirement and potential system impact.

Remediation

Immediate action: update Coolify to version 4.1.2 or later to obtain the improved input validation controls. Before updating, test the new version in a non-production environment to ensure compatibility with your deployment workflows. If immediate patching is not possible, restrict administrative and developer access to Coolify to trusted personnel only, monitor for suspicious command patterns in logs, and consider isolating the Coolify server from sensitive network segments.

Patch guidance

Upgrade to Coolify 4.1.2 or later. Verify compatibility with your current deployment configurations before rolling out to production. The vendor has not provided a dedicated security advisory, so cross-reference the 4.1.2 release notes against your deployment to confirm the input validation improvements apply to your usage patterns. No interim workarounds have been published; patching is the primary remediation path.

Detection guidance

Monitor Coolify server logs for unusual shell metacharacters or command structures in image name, branch, or proxy configuration parameters. Look for payloads containing characters such as semicolons, pipes, backticks, dollar signs, or ampersands in deployment requests. Correlate Coolify API logs with system-level command execution logs (auditd, sysmon) to detect unexpected process spawning originating from the Coolify service account. Network-based detection is limited without payload inspection; prioritize application log analysis.

Why prioritize this

Although authentication is required, the combination of direct OS command execution capability, potential for full infrastructure compromise via the deployment control plane, and a permissive attack complexity warrants prompt patching. Organizations heavily dependent on Coolify for multi-application orchestration should treat this as a near-term priority. The lack of public exploits and KEV listing slightly reduces urgency compared to actively exploited vulnerabilities, but this should not delay patching beyond standard change windows.

Risk score, explained

The CVSS 3.1 score of 6.3 (MEDIUM) reflects: remote network accessibility (AV:N), low attack complexity (AC:L), requirement for legitimate user authentication (PR:L), no additional user interaction needed (UI:N), single security domain impact (S:U), and all three basic impacts present at low severity (C:L/I:L/A:L). The authentication barrier prevents a higher score despite the dangerous nature of OS command injection. In environments where Coolify access is tightly controlled, risk may be lower; in shared or loosely managed deployments, actual risk may exceed the base score.

Frequently asked questions