PT-2026-84573

CVE-2026-84694

Published

2026-09-02

Updated

2026-09-02

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.2.0

Description Authenticated attackers can execute arbitrary commands on the server host outside of containers. This occurs because the software fails to properly escape environment variable key names when executing Docker commands over SSH on managed servers, allowing the injection of shell metacharacters into these keys.

Recommendations Update to version 4.2.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jaime Ramírez

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers