CVE-2026-42201

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, database credential fields (redis_password, keydb_password, dragonfly_password, clickhouse_admin_user, clickhouse_admin_password, postgres_user, mysql_user) are validated only as 'string' at the API layer, with zero shell-safety checks. These values are then interpolated directly into Docker Compose YAML command: strings without any escaping. This issue is fixed in version 4.0.0-beta.474.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.7 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/coollabsio/coolify/commit/bff6d853708f3d7c861279586f107739036e67da
https://github.com/coollabsio/coolify/pull/9676
https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.474
https://github.com/coollabsio/coolify/security/advisories/GHSA-f35h-g2c2-q36v
https://github.com/coollabsio/coolify/security/advisories/GHSA-f35h-g2c2-q36v

Configurations

No configuration.

History

25 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Coolify es una herramienta de código abierto y autoalojable para gestionar servidores, aplicaciones y bases de datos. Antes de la versión 4.0.0-beta.474, los campos de credenciales de la base de datos (redis_password, keydb_password, dragonfly_password, clickhouse_admin_user, clickhouse_admin_password, postgres_user, mysql_user) se validan solo como ’string’ en la capa de la API, sin ninguna comprobación de seguridad de shell. Estos valores se interpolan directamente en cadenas de comando YAML de Docker Compose sin ningún escape. Este problema está solucionado en la versión 4.0.0-beta.474.

Information

Published : 2026-07-07 05:16

Updated : 2026-10-25 20:10

NVD link : CVE-2026-42201

Mitre link : CVE-2026-42201

CVE.ORG link : CVE-2026-42201

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-42201", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42201", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-07T13:58:05.000375Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 0.7}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "coollabsio", "product": "coolify", "versions": [{"status": "affected", "version": "< 4.0.0-beta.474"}]}]}], "published": "2026-07-07T05:16:51.237", "references": [{"url": "https://github.com/coollabsio/coolify/commit/bff6d853708f3d7c861279586f107739036e67da", "source": "security-advisories@github.com"}, {"url": "https://github.com/coollabsio/coolify/pull/9676", "source": "security-advisories@github.com"}, {"url": "https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.474", "source": "security-advisories@github.com"}, {"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-f35h-g2c2-q36v", "source": "security-advisories@github.com"}, {"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-f35h-g2c2-q36v", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, database credential fields (redis_password, keydb_password, dragonfly_password, clickhouse_admin_user, clickhouse_admin_password, postgres_user, mysql_user) are validated only as 'string' at the API layer, with zero shell-safety checks. These values are then interpolated directly into Docker Compose YAML command: strings without any escaping. This issue is fixed in version 4.0.0-beta.474."}, {"lang": "es", "value": "Coolify es una herramienta de c\u00f3digo abierto y autoalojable para gestionar servidores, aplicaciones y bases de datos. Antes de la versi\u00f3n 4.0.0-beta.474, los campos de credenciales de la base de datos (redis_password, keydb_password, dragonfly_password, clickhouse_admin_user, clickhouse_admin_password, postgres_user, mysql_user) se validan solo como \u2019string\u2019 en la capa de la API, sin ninguna comprobaci\u00f3n de seguridad de shell. Estos valores se interpolan directamente en cadenas de comando YAML de Docker Compose sin ning\u00fan escape. Este problema est\u00e1 solucionado en la versi\u00f3n 4.0.0-beta.474."}], "lastModified": "2026-10-25T20:10:00.147", "sourceIdentifier": "security-advisories@github.com"}