CVE-2026-42143
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Coolify prior to version 4.0.0-beta.471 has a vulnerability where user-controlled persistent volume names are interpolated into shell commands executed on managed servers without escaping or validation. This allows an authenticated member to inject shell metacharacters and execute commands as root when volume operations are triggered.
Risk Assessment
An attacker with access to the Coolify panel can gain full control over managed servers, compromising the confidentiality, integrity, and availability of data and the entire infrastructure.
Recommendation
Immediately update Coolify to version 4.0.0-beta.471 or later, which contains the fix for this vulnerability.
Original NVD description (English source)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, user-controlled persistent volume names are interpolated into shell commands executed on managed servers without escaping or validation, allowing an authenticated member to inject shell metacharacters and execute commands as root when volume operations are triggered. This issue appears to be fixed in version 4.0.0-beta.471.