CVE-2026-42148: Coolify Command Injection in Development Helper Image Build

Technical summary

CVE-2026-42148 is a OS command injection vulnerability (CWE-78) in Coolify's buildHelperImage method located in app/Livewire/Settings/Index.php. The method constructs a Docker build command by directly interpolating the dev_helper_version field without shell escaping or sanitization. An authenticated user with administrative privileges can inject shell metacharacters into this field, and when the helper image build is triggered, those commands execute with the privileges of the Coolify process. The attack surface is restricted to development environments where this functionality is accessible.

Business impact

Organizations using Coolify in development environments face a localized command execution risk, but the threat is substantially mitigated by the required privileges (administrator account), user interaction needed to trigger the build, and the local-only attack surface. Production deployments are unaffected. For development teams, the practical impact depends on the sensitivity of the development infrastructure and whether non-trusted users have administrative access. The low CVSS score (3.8) reflects these constraints.

Affected systems

Coolify versions prior to 4.0.0-beta.474 are affected. The buildHelperImage method is part of the core Settings module, so any Coolify installation running an earlier version is technically vulnerable, though exploitation requires specific conditions: administrative access, the ability to modify the dev_helper_version setting, and the ability to trigger a helper image build in a development context.

Exploitability

Exploitation requires three conditions to align: an attacker must possess administrative credentials or deceive an administrator into performing the malicious action, modify the dev_helper_version field to include shell injection payloads, and trigger the helper image build process. These prerequisites significantly reduce the practical exploitability. The vulnerability is not remotely exploitable without prior authentication and privilege compromise. There is no evidence of active exploitation or inclusion in public exploit databases.

Remediation

Upgrade Coolify to version 4.0.0-beta.474 or later. The patch implements proper shell escaping for the dev_helper_version parameter before constructing the Docker command. Organizations should verify the update is applied and confirm the helper image build function operates normally post-patch. For development teams unable to upgrade immediately, restrict administrative access to trusted personnel only and monitor for suspicious modifications to helper version settings.

Patch guidance

Coolify maintainers released version 4.0.0-beta.474 as the remedial version. Users should update through Coolify's standard update mechanism. Verify the patched version is running by checking the Coolify dashboard or logs. If your deployment is still in beta versions, prioritize upgrading to the patched beta release or the next stable release when available. Test the update in a non-production environment first to ensure compatibility with custom configurations.

Detection guidance

Monitor Coolify application logs and system audit logs for: (1) modifications to the dev_helper_version field in the Settings module, particularly entries containing shell metacharacters (pipes, semicolons, backticks, dollar signs, or parentheses); (2) Docker build command executions with unexpected parameters or commands; (3) process execution events spawned by the Coolify application process that appear anomalous. Check Coolify's version regularly to ensure you are not running a vulnerable release. Consider enabling verbose logging in development environments to capture build activity.

Why prioritize this

Although the CVSS score is low (3.8), this is a command injection vulnerability that yields arbitrary code execution. However, prioritization should be tempered by the stringent prerequisites: administrative access, local attack surface, and required user interaction. Development teams using Coolify should patch within their normal maintenance cycle. Organizations that restrict administrative access to trusted staff can deprioritize this below critical infrastructure vulnerabilities, but should still schedule a patch within 30–60 days. If your development environment is accessible to untrusted users or contractors, elevate the timeline to immediate action.

Risk score, explained

The CVSS:3.1 score of 3.8 (LOW) reflects a vulnerability that, while technically severe (arbitrary command execution), is constrained by attack vector (Local), attack complexity (High—user interaction required), required privilege level (High—administrator), and user interaction requirement. The scope is unchanged and the confidentiality, integrity, and availability impacts are rated low because the actual damage depends on the environment's value and the attacker's objectives. In a high-trust development environment, the score fairly represents the risk; in a multi-tenant or adversarial development setup, operational risk may be higher.

Frequently asked questions