CVE-2026-27957: Coolify Authenticated Command Injection in Certificate Management

Technical summary

CVE-2026-27957 is an authenticated command injection vulnerability (CWE-78) in Coolify's CA Certificate management feature. The flaw permits authenticated users to inject and execute arbitrary commands that execute as the configured SSH user account on the target managed server. Given that Coolify requires the SSH user to possess root privileges or docker group membership for normal operation, exploitation results in full system compromise including all running containers. The vulnerability is network-accessible and requires only valid authentication credentials to trigger—no user interaction is needed.

Business impact

Compromise of a Coolify instance exposes all managed infrastructure under that deployment. An attacker with valid credentials can execute arbitrary workloads, exfiltrate application data, manipulate containerized services, compromise dependent databases, and establish persistent backdoors. For organizations using Coolify to manage production environments, this vulnerability threatens confidentiality, integrity, and availability of their entire application stack. The blast radius extends beyond the Coolify host itself to every server and service it manages.

Affected systems

Coolify versions prior to 4.0.0-beta.464 are affected. The vulnerability is present in all authentication contexts—any user with valid credentials (administrative, standard user, or service account) can exploit it. No special permissions beyond basic authentication are required. The risk is elevated in deployments managing critical infrastructure or multiple production environments.

Exploitability

This vulnerability is straightforward to exploit. It requires only network access to a Coolify instance and valid authentication credentials. The attack vector is unauthenticated-network-accessible (CVSS score 8.8, HIGH severity). No special exploitation techniques, race conditions, or user interaction are necessary. The low complexity and low privilege barrier make this a high-priority remediation target for any organization running Coolify.

Remediation

Organizations must upgrade Coolify to version 4.0.0-beta.464 or later. Because the vulnerability is exploitable by any authenticated user and grants root-level command execution, patching should be treated as urgent. Verify the patch version against the official Coolify release notes before deployment. Test upgrades in a non-production environment first, as beta releases may introduce other changes.

Patch guidance

Upgrade Coolify to version 4.0.0-beta.464 or later as soon as operationally feasible. Review the official Coolify release notes and upgrade documentation to understand any breaking changes or migration steps. For environments managing critical services, schedule upgrades during a maintenance window and verify that all managed servers and containers return to expected operational state post-upgrade. If immediate patching is not possible, consider restricting authentication access to trusted accounts only and monitoring certificate management activity closely.

Detection guidance

Monitor Coolify logs and SSH audit logs on managed servers for suspicious command execution patterns, especially in the CA Certificate management workflow. Look for unexpected system commands, unusual privilege escalation attempts, or lateral movement activity originating from Coolify's configured SSH user account. Review authentication logs for unusual access patterns or credential usage. Network-level detection should flag abnormal outbound connections initiated by containers or services managed through a potentially compromised Coolify instance.

Why prioritize this

This vulnerability merits immediate attention due to its combination of high severity, ease of exploitation, and catastrophic impact. Any authenticated user can gain root-level command execution on managed infrastructure with no special techniques required. For organizations managing production services through Coolify, this represents a critical control failure that can lead to full infrastructure compromise. The CVSS 8.8 score reflects the high risk, and the lack of compensating controls makes rapid patching essential.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: network-accessible attack vector (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L, any authenticated user), no user interaction needed (UI:N), unchanged scope (S:U), and high impact to confidentiality, integrity, and availability (C:H/I:H/A:H). The score appropriately captures the severity of authenticated remote command injection with root-level consequences. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, but should be treated with equivalent urgency given its exploitability and impact.

Frequently asked questions