CVE-2026-42201
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In Coolify prior to version 4.0.0-beta.474, database credential fields (redis_password, keydb_password, dragonfly_password, clickhouse_admin_user, clickhouse_admin_password, postgres_user, mysql_user) are validated only as 'string' with no shell-safety checks. These values are then interpolated directly into Docker Compose YAML command strings without any escaping, allowing command injection.
Risk Assessment
An attacker can exploit this vulnerability to execute arbitrary commands in Docker containers, leading to application compromise, data leakage, or privilege escalation within the managed infrastructure.
Recommendation
Immediately upgrade Coolify to version 4.0.0-beta.474 or later, which fixes the issue by properly escaping input data to prevent command injection.
Original NVD description (English source)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, database credential fields (redis_password, keydb_password, dragonfly_password, clickhouse_admin_user, clickhouse_admin_password, postgres_user, mysql_user) are validated only as 'string' at the API layer, with zero shell-safety checks. These values are then interpolated directly into Docker Compose YAML command: strings without any escaping. This issue is fixed in version 4.0.0-beta.474.