CVE-2026-42153: Coolify PostgreSQL Command Injection – High Severity Authentication Bypass

Technical summary

The vulnerability stems from unsafe shell command construction in PostgreSQL healthcheck logic. Coolify builds shell-form commands using user-supplied input from postgres_user and postgres_db configuration parameters without proper sanitization or parameterization. An authenticated attacker can embed shell metacharacters and command separators into these fields—for example, injecting backticks, $(), or semicolons—causing the database container to execute unintended commands. The root cause is classified as CWE-78 (OS Command Injection). The attack surface is limited to authenticated users, but once exploited, an attacker gains the execution context of the database container process.

Business impact

Compromise of a Coolify-managed database container can lead to data exfiltration, database corruption, lateral movement to other containers or hosts on the network, or denial of service. Organizations relying on Coolify for multi-tenant or multi-application deployments face elevated risk of cascading failures if a single compromised database container is leveraged to attack infrastructure components. The impact is particularly severe in environments where Coolify manages sensitive databases or connects to production systems.

Affected systems

Coolify versions prior to 4.0.0-beta.474 are affected. The vulnerability requires an authenticated user account on the Coolify platform; it does not affect unauthenticated external users. Self-hosted Coolify instances are the primary exposure vector. Organizations running Coolify in containerized or Kubernetes environments should prioritize assessment, as the injected commands execute directly in the database container context.

Exploitability

Exploitability is moderate in scope. The attack requires prior authentication to Coolify, which raises the barrier compared to unauthenticated vulnerabilities. However, authentication can be achieved through compromised credentials, insider threats, or compromised integrated development environments linked to Coolify. Once authenticated, the injection is straightforward—modifying database settings is a typical user action, and no special tools or techniques are required. An attacker with database admin or configuration privileges can immediately weaponize this flaw.

Remediation

Upgrade Coolify to version 4.0.0-beta.474 or later. This version contains fixes that sanitize postgres_user and postgres_db parameters, preventing command injection. Organizations unable to upgrade immediately should restrict Coolify access to trusted users, implement network segmentation to isolate database containers, and monitor container execution logs for suspicious command patterns.

Patch guidance

Apply the patch by upgrading Coolify to 4.0.0-beta.474 or a newer stable release when available. Verify patch deployment by confirming the version in Coolify's administration interface. For self-hosted instances, follow the standard Coolify update procedure documented in the project repository. Test the upgrade in a non-production environment first to ensure compatibility with your existing database configurations. No database migration or configuration rollback is required; the fix is backward-compatible.

Detection guidance

Monitor Coolify database container logs and audit trails for commands that contain unusual shell metacharacters or suspicious patterns in postgres_user or postgres_db fields. Inspect Coolify configuration backups or exported settings for evidence of injected payloads. On the host level, use container runtime security tools to detect unexpected process execution within database containers, particularly child processes spawned from the healthcheck mechanism. Check for authentication logs showing unusual user account modifications tied to database configuration changes.

Why prioritize this

This vulnerability scores 8.8 (HIGH severity) due to its potential for complete compromise of database containers and the presence of high-impact capabilities: confidentiality, integrity, and availability are all at risk. Although authentication is required, the relatively low effort to exploit once authenticated, combined with the critical role databases play in infrastructure, justifies immediate attention. Organizations with externally-facing Coolify instances or those managing production databases should treat this as a priority patch.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: Network attack vector (N), Low attack complexity (L), requiring Low privileges (authentication, L), and no user interaction (N). The impact across confidentiality, integrity, and availability is High (H) for all three, indicating complete compromise of the affected resource scope. The scope is unchanged (U), meaning the vulnerability does not affect resources beyond the vulnerable component itself, though the nature of the injected commands could enable lateral movement in practice.

Frequently asked questions