CVE-2026-34158: Coolify Command Injection via Docker Settings - Patch Now

Technical summary

The vulnerability exists in the executeInDocker() helper function, which constructs shell commands by wrapping user-controlled inputs in single quotes without sanitizing embedded quotes. When a user with settings edit capability provides a single quote in docker_compose_custom_build_command or docker_compose_custom_start_command fields, the quote terminates the intended quoted string, allowing subsequent shell syntax to execute in the host context rather than within the isolated container. This breaks the security boundary that Docker containerization is meant to enforce. The flaw affects all Coolify versions prior to 4.0.0-beta.469.

Business impact

Organizations self-hosting Coolify to manage their infrastructure face direct host compromise during application deployments—the most critical workflow in the tool. An insider, compromised privileged account, or lateral movement actor with settings access could execute arbitrary code with the privileges of the Coolify daemon process, potentially capturing credentials, exfiltrating data, pivoting to other systems, or establishing persistence. For teams using Coolify to manage production databases and applications, this effectively grants an authenticated attacker control over managed infrastructure and data.

Affected systems

Coolify versions prior to 4.0.0-beta.469 are vulnerable. The tool is self-hosted, so affected organizations are those running Coolify on-premises or in private cloud environments. The vulnerability requires an authenticated user with permissions to edit application settings—typically administrators or privileged deployment operators. The actual blast radius depends on how the hosting organization restricts settings access and whether Coolify itself runs with elevated privileges on the host.

Exploitability

Exploitation requires valid Coolify credentials and settings-edit permissions, placing this in the 'authenticated' attacker category. However, once access is obtained—through phishing, credential stuffing, insider threat, or account compromise—the attack is trivial: inject a single quote into a docker command field and the payload executes during the next deployment. No user interaction is required beyond the attacker modifying settings. The low attack complexity and direct code execution path make this highly exploitable within the scope of authenticated threats.

Remediation

Upgrade Coolify to version 4.0.0-beta.469 or later immediately. This version patches the executeInDocker() function to properly escape or parameterize command construction, preventing quote injection. Organizations unable to upgrade immediately should restrict settings-edit permissions to a minimal set of highly trusted administrators and monitor deployment logs for suspicious docker command modifications or unexpected host process execution during deployments.

Patch guidance

Apply Coolify version 4.0.0-beta.469 or any subsequent stable release. Verify the patch by reviewing the release notes or changelog for confirmation that the executeInDocker() command injection fix is included. Test the upgrade in a non-production environment first to ensure custom Docker build and start commands still function as intended post-patch. After patching, audit recent deployment logs and settings changes to detect any prior exploitation attempts.

Detection guidance

Monitor Coolify deployment logs and audit trails for anomalous modifications to docker_compose_custom_build_command or docker_compose_custom_start_command fields, particularly additions of special characters or shell metacharacters (quotes, semicolons, pipes, backticks). Track which users modify these settings and when. On the host system running Coolify, correlate deployment activity with unexpected process execution outside the container sandbox—examine host process logs and syscall traces for commands spawned by the Coolify daemon during deployments. Look for shell invocations, credential access, or network connections that do not match legitimate application behavior.

Why prioritize this

This vulnerability merits immediate attention despite the authenticated prerequisite. The impact is severe—arbitrary code execution on managed infrastructure—and the attack is trivial to execute once credentials are obtained. Organizations running Coolify in production are managing critical infrastructure; compromise here cascades to dependent applications and databases. The fix is a version upgrade away, making delay unjustifiable. Prioritize this above lower-impact vulnerabilities, especially if Coolify administrators have broad privileges or if settings edit permissions are granted to many users.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects the confluence of high confidentiality, integrity, and availability impact (C:H/I:H/A:H) against the host system, combined with network accessibility and low attack complexity (AV:N/AC:L). The score appropriately assumes the attacker is authenticated (PR:L), which accurately models the threat surface: anyone with legitimate but compromised Coolify credentials can trigger catastrophic host compromise. The unchanged scope (S:U) correctly notes that the impact is confined to the host running Coolify—not a wider network—but that is still critical given Coolify's role managing production infrastructure.

Frequently asked questions