CVE-2026-42201

LOW 3.3

Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

CVSS Score

3.3

EPSS Score

0.2%

EPSS Percentile

9th

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, database credential fields (redis_password, keydb_password, dragonfly_password, clickhouse_admin_user, clickhouse_admin_password, postgres_user, mysql_user) are validated only as 'string' at the API layer, with zero shell-safety checks. These values are then interpolated directly into Docker Compose YAML command: strings without any escaping. This issue is fixed in version 4.0.0-beta.474.

CWE	CWE-78
Vendor	coollabsio
Product	coolify
Published	Jul 7, 2026
Last Updated	Jul 7, 2026

Stay Ahead of the Next One

Get instant alerts for coollabsio coolify

Be the first to know when new low vulnerabilities affecting coollabsio coolify are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

coollabsio / coolify

< 4.0.0-beta.474

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/coollabsio/coolify/security/advisories/GHSA-f35h-g2c2-q36v github.com: https://github.com/coollabsio/coolify/pull/9676 github.com: https://github.com/coollabsio/coolify/commit/bff6d853708f3d7c861279586f107739036e67da github.com: https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.474