CVE-2026-42153
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Coolify prior to version 4.0.0-beta.474 contains a command injection vulnerability in the PostgreSQL healthcheck command generation. An authenticated attacker can exploit attacker-controlled database settings (postgres_user and postgres_db) to inject arbitrary commands executed in the database container.
Risk Assessment
The risk involves unauthorized command execution within the database container, potentially leading to data confidentiality, integrity, or availability breaches and further privilege escalation within the Coolify environment.
Recommendation
Immediately upgrade Coolify to version 4.0.0-beta.474 or later, which includes a fix that eliminates the command injection vulnerability.
Original NVD description (English source)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL healthcheck command generation used attacker-controlled database settings (postgres_user and postgres_db) in shell-form commands, allowing an authenticated user to inject commands executed in the database container. This issue is fixed in version 4.0.0-beta.474.