CVE-2026-42143: Coolify Command Injection via Persistent Volume Names (CVSS 8.8)

Technical summary

The vulnerability is a command injection flaw (CWE-78) stemming from insufficient input sanitization. When users create or modify persistent volumes in Coolify, their supplied volume names are interpolated directly into shell commands executed on managed servers. Because these names are not escaped or validated before execution, an authenticated attacker can inject shell metacharacters (such as semicolons, pipes, or command substitution syntax) to break out of the intended command context and execute arbitrary shell code. The execution context is the root user on the managed server, providing complete system compromise. The issue was remediated in version 4.0.0-beta.471, likely through input validation and proper shell escaping mechanisms.

Business impact

Organizations running Coolify as a self-hosted infrastructure management tool face elevated risk of internal threats and lateral movement. Because the attack requires authentication and is triggered during routine volume operations, insider threats or compromised accounts with Coolify access become dangerous attack vectors. A successful exploitation could lead to unauthorized access to managed servers, data exfiltration, malicious application deployment, or denial of service. For platforms managing multiple customer environments or critical infrastructure, this escalates to potential multi-tenant compromise depending on Coolify's isolation architecture.

Affected systems

Coolify versions prior to 4.0.0-beta.471 are vulnerable. The advisory does not specify which earlier beta or stable versions are affected, though as a beta-series issue in a tool tracking version 4.0.0, it likely affects all earlier 4.0.0-beta releases and potentially earlier stable versions. Organizations should verify their Coolify installation version and upgrade if running any pre-4.0.0-beta.471 release. The vulnerability requires network access to the Coolify interface and valid authentication credentials.

Exploitability

Exploitability is moderate-to-high in realistic scenarios. The attack requires valid Coolify credentials, which raises the bar compared to unauthenticated exploits but is not exceptional in environments where multiple team members have platform access. No CVSS exploitation complexity penalty applies, meaning the attack is straightforward once credentials are obtained. However, the exploitation is not passive—it requires an authenticated actor to deliberately create a malicious volume with injected commands. There is no indication of public exploit code or active in-the-wild exploitation. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

The definitive remediation is to upgrade to Coolify version 4.0.0-beta.471 or later. Organizations should prioritize this update given the HIGH severity and root-level command execution risk. Before patching, compensating controls include restricting Coolify platform access to trusted team members, implementing network segmentation to limit lateral movement from managed servers, and monitoring volume creation and modification operations for suspicious input patterns (e.g., shell metacharacters in volume names). However, these controls do not eliminate the underlying flaw and should not delay patching.

Patch guidance

Verify your current Coolify version via the administrative interface or logs. If you are running any version prior to 4.0.0-beta.471, update immediately using Coolify's standard upgrade mechanism (typically docker pull and restart for self-hosted deployments). Test the upgrade in a staging environment first if managing critical infrastructure. The patch is marked as fixing the issue, implying no known regressions or compatibility breaks, but as with any beta-series update, review release notes for environment-specific considerations. After upgrade, verify volume operations function normally and re-validate any persistent volume configurations.

Detection guidance

Monitor Coolify application logs and server audit logs (syslog, auditd) for: (1) volume creation or modification events with suspicious characters or unexpected string patterns in volume names (semicolons, backticks, dollar signs, pipe characters); (2) unexpected shell commands executed by the Coolify service or root-context processes following volume operations; (3) authentication events for Coolify by accounts that do not typically interact with the platform. Log aggregation and parsing rules targeting these patterns will help detect exploitation attempts. Additionally, review recent volume operations in your Coolify instance for any anomalous names created between when the system was first vulnerable and when patches were applied.

Why prioritize this

This vulnerability merits immediate patching priority due to the combination of HIGH CVSS score (8.8), root-level execution context, and direct impact to server infrastructure management. While it requires authentication, the blast radius—compromising the systems Coolify is meant to orchestrate—is severe. For any organization using Coolify to manage production or sensitive infrastructure, unpatched instances represent a critical internal security gap. The fact that this is a beta version also suggests the project may be rapidly evolving; staying current with patches is part of responsible self-hosted adoption.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: (1) network-accessible attack vector (AV:N), (2) low attack complexity requiring only valid credentials and standard platform interaction (AC:L), (3) authentication requirement limiting the initial attack pool (PR:L), (4) no user interaction needed—volume operations are routine administrative actions (UI:N), (5) scope unchanged—the attacker remains within the Coolify service context but gains root command execution (S:U), and (6) high confidentiality, integrity, and availability impact (C:H/I:H/A:H) due to unrestricted command execution as root. The score appropriately weights the privileged context and broad system compromise potential, though the authentication requirement prevents a 9.0+ critical rating.

Frequently asked questions