CVE-2026-59734 Coolify Command Injection in Health Check Parameters

Technical summary

The vulnerability exists in Coolify's ApplicationDeploymentJob.php file, specifically in the generate_healthcheck_commands() function. This function constructs shell commands by directly interpolating three user-controlled parameters—health_check_host, health_check_method, and health_check_path—without input validation or shell escaping. An authenticated attacker can inject shell metacharacters (pipes, semicolons, backticks, command substitution syntax) into these parameters to break out of the intended command context and execute arbitrary commands. The injected commands run with the privileges of the deployment container process, potentially allowing data exfiltration, lateral movement, or container escape depending on the runtime configuration.

Business impact

Compromise of a Coolify instance can lead to unauthorized access to all deployed applications, databases, and server infrastructure managed through that instance. An insider threat or compromised account holder can silently inject malicious code into production deployments, exfiltrate sensitive data, or disrupt service availability. For organizations using Coolify to manage customer deployments or multi-tenant infrastructure, a single compromised admin or developer account could cascade to affect all downstream customers and applications.

Affected systems

Coolify versions prior to 4.0.0-beta.469 are affected. The vulnerability requires an authenticated user account, so it does not directly impact unauthenticated instances or air-gapped deployments without external user access. Self-hosted Coolify instances and any platform built atop Coolify that exposes the health check configuration API are in scope.

Exploitability

The attack requires valid authentication credentials, which raises the bar compared to unauthenticated exploits. However, in typical deployment scenarios, developers and operations staff routinely have Coolify access, and credential compromise through phishing, insider threats, or lateral movement from other breaches is common. The vulnerability is straightforward to exploit once authenticated—modifying health check parameters requires only standard web interface interaction or API calls. No complex exploitation chains or race conditions are needed.

Remediation

Upgrade Coolify to version 4.0.0-beta.469 or later. This patch version implements proper input sanitization and shell-safe parameter passing for health check commands. Organizations unable to upgrade immediately should restrict Coolify access to a minimal set of trusted users and monitor health check parameter modifications in audit logs.

Patch guidance

Apply the Coolify upgrade to version 4.0.0-beta.469 as your primary remediation. Verify the upgrade by checking the Coolify version string in the UI or by inspecting the deployed image tag if using containerized deployments. Test health check functionality after upgrade to confirm no regression in legitimate health check workflows. If you are on a stable release channel (non-beta), monitor the Coolify release notes for when this fix ships in a stable 4.0.0 or later GA release.

Detection guidance

Monitor Coolify audit logs for modifications to application health check parameters, particularly changes to health_check_host, health_check_method, or health_check_path that contain unusual syntax or shell metacharacters. Search logs for patterns like semicolons, pipes, backticks, dollar signs, or command substitution syntax within these fields. Check container execution logs for unexpected commands spawned by the deployment job process. If you have network telemetry, watch for outbound connections initiated from deployment containers that do not match the expected application traffic.

Why prioritize this

This vulnerability merits urgent patching because it grants authenticated users full code execution within containers that often have access to production databases, secrets, and other critical infrastructure. The CVSS 8.8 (HIGH) score reflects high impact (confidentiality, integrity, availability all compromised) and low attack complexity. While authentication is required, the pool of potential attackers (developers, ops staff, contractors) and the frequency of credential compromise make this a real and present risk. Organizations should treat this as a priority-1 patch if they run multi-user Coolify instances or manage sensitive workloads.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) is driven by three factors: (1) Network-accessible attack vector—Coolify is typically accessed over the network; (2) Low attack complexity—no special conditions or race conditions needed beyond authentication; (3) High impact across all three security properties—an attacker can read sensitive data (confidentiality), modify deployed code or configurations (integrity), and crash containers or applications (availability). The requirement for prior authentication (PR:L) prevents a perfect 9.0+ score, but the real-world risk remains substantial because authenticated compromise is common.

Frequently asked questions