CVE-2026-27957

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, an authenticated command injection vulnerability in the CA Certificate management feature allows any authenticated user to execute arbitrary commands as the configured SSH user on the managed server host. As the SSH user typically would have to either be root or part of the docker group for Coolify to function as intended, this provides complete compromise of the managed server and associated docker containers. This vulnerability is fixed in 4.0.0-beta.464.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/coollabsio/coolify/security/advisories/GHSA-7g97-c4xv-3cjx
https://github.com/coollabsio/coolify/security/advisories/GHSA-7g97-c4xv-3cjx

Configurations

No configuration.

History

25 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Coolify es una herramienta de código abierto y autoalojable para gestionar servidores, aplicaciones y bases de datos. Anteriormente a la 4.0.0-beta.464, una vulnerabilidad de inyección de comandos autenticada en la función de gestión de certificados CA permite a cualquier usuario autenticado ejecutar comandos arbitrarios como el usuario SSH configurado en el host del servidor gestionado. Dado que el usuario SSH normalmente tendría que ser root o parte del grupo docker para que Coolify funcione según lo previsto, esto proporciona un compromiso completo del servidor gestionado y los contenedores docker asociados. Esta vulnerabilidad se ha corregido en la 4.0.0-beta.464.

Information

Published : 2026-06-30 15:16

Updated : 2026-10-25 21:10

NVD link : CVE-2026-27957

Mitre link : CVE-2026-27957

CVE.ORG link : CVE-2026-27957

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-27957", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27957", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-30T15:29:10.351560Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "coollabsio", "product": "coolify", "versions": [{"status": "affected", "version": "< 4.0.0-beta.464"}]}]}], "published": "2026-06-30T15:16:52.863", "references": [{"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-7g97-c4xv-3cjx", "source": "security-advisories@github.com"}, {"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-7g97-c4xv-3cjx", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, an authenticated command injection vulnerability in the CA Certificate management feature allows any authenticated user to execute arbitrary commands as the configured SSH user on the managed server host. As the SSH user typically would have to either be root or part of the docker group for Coolify to function as intended, this provides complete compromise of the managed server and associated docker containers. This vulnerability is fixed in 4.0.0-beta.464."}, {"lang": "es", "value": "Coolify es una herramienta de c\u00f3digo abierto y autoalojable para gestionar servidores, aplicaciones y bases de datos. Anteriormente a la 4.0.0-beta.464, una vulnerabilidad de inyecci\u00f3n de comandos autenticada en la funci\u00f3n de gesti\u00f3n de certificados CA permite a cualquier usuario autenticado ejecutar comandos arbitrarios como el usuario SSH configurado en el host del servidor gestionado. Dado que el usuario SSH normalmente tendr\u00eda que ser root o parte del grupo docker para que Coolify funcione seg\u00fan lo previsto, esto proporciona un compromiso completo del servidor gestionado y los contenedores docker asociados. Esta vulnerabilidad se ha corregido en la 4.0.0-beta.464."}], "lastModified": "2026-10-25T21:10:00.770", "sourceIdentifier": "security-advisories@github.com"}