CVE-2026-42201: Coolify Database Credential Command Injection Vulnerability

Technical summary

CVE-2026-42201 is a command injection flaw in Coolify's credential handling layer. The application validates database credential fields (redis_password, keydb_password, dragonfly_password, clickhouse_admin_user, clickhouse_admin_password, postgres_user, mysql_user) only as generic strings at the API level, with no sanitization or escaping. These unsanitized values are then directly interpolated into Docker Compose YAML command syntax. An authenticated administrator can inject shell metacharacters (backticks, dollar-parentheses, semicolons, pipes, etc.) into these fields, which will be executed as shell commands when Docker Compose processes the configuration. This maps to CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Business impact

The practical risk is limited by the high privilege requirement—only administrators can set database credentials. However, for organizations using Coolify in multi-tenant or delegated-administration scenarios, a rogue admin could escalate from credential management to arbitrary code execution on the host system. This could lead to data exfiltration, lateral movement to other applications or databases, or infrastructure compromise. For single-admin deployments, the risk is lower but still present if the admin account is compromised.

Affected systems

All versions of Coolify prior to 4.0.0-beta.474 are affected. The vulnerability resides in the core credential-handling mechanism and affects any deployment that uses the vulnerable versions to manage containerized databases via Docker Compose.

Exploitability

Exploitation requires administrative authentication to the Coolify platform—an external attacker cannot trigger this remotely without valid credentials. The attack complexity is also rated as 'high' because the attacker must craft a payload that survives Docker Compose's YAML parsing and shell interpretation. No public exploit code or proof-of-concept is known to be actively circulating, and the vulnerability is not tracked in the Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Upgrade Coolify to version 4.0.0-beta.474 or later, which implements proper escaping and validation of database credential fields before interpolation into Docker Compose configuration. Organizations unable to upgrade immediately should restrict administrative access to trusted personnel and monitor for suspicious credential configurations.

Patch guidance

Update to Coolify 4.0.0-beta.474 or any subsequent stable release. Review the Coolify GitHub repository and official release notes for patch availability and installation instructions. For users on beta channels, the fix is available in beta.474; stable release versions incorporating this fix should be tracked on the project's release page. Verify the installed version against the vendor advisory prior to assuming mitigation.

Detection guidance

Monitor Coolify audit logs for credential field modifications, particularly those containing unusual characters (backticks, dollar signs, semicolons, pipes, newlines). Inspect exported or active Docker Compose configurations for unexpected shell syntax in credential values. If logs are unavailable, manually review the Coolify database or configuration store for injected payloads in the affected credential fields. Look for patterns like `$(command)`, `; command`, or backtick-enclosed commands within redis_password, postgres_user, mysql_user, and related fields.

Why prioritize this

Although rated LOW in CVSS, this vulnerability deserves attention because it bridges credential management to OS command execution. The high privilege requirement and high attack complexity reduce the baseline risk, but the impact—if exploited—is severe (full host compromise). Prioritize patching in environments where delegation or role-based admin access is used. Single-admin, air-gapped Coolify instances present lower urgency.

Risk score, explained

CVSS 3.1 score of 3.3 (LOW) reflects the requirement for high-privilege authentication (PR:H), high attack complexity (AC:H), and local network access (AV:N mitigated by privilege gate). Impact is limited to low confidentiality and integrity (C:L, I:L) with no availability impact (A:N). The score does not account for operational context—isolated, low-trust Coolify instances bear less risk than those with shared admin duties.

Frequently asked questions