FR
live
High CVSS 8.8

CVE-2026-42143

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, user-controlled persistent volume names are interpolated into shell commands executed on managed servers without escaping or validation, allowing an authenticated member to inject shell metacharacters and execute commands as root when volume operations are triggered. This issue appears to be fixed in version 4.0.0-beta.471.

What this means

Exposure
Exploitable remotely over the network, with an ordinary user account and with no action from the victim.
Impact
An attacker can read sensitive data, modify or destroy data and take the service offline.
Weakness
Unfiltered input reaches the system shell, letting the attacker run their own commands on the server.
Likelihood
Its EPSS score stays low: nothing points to imminent exploitation, which is no reason to leave it unpatched.

What to doFold into the next patch cycle.

Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.

Published
7 July 2026
CVSS
8.8 (v3.1) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.44% probability of exploitation within 30 days · above 36% of all CVEs
Weakness
CWE-78
Sources
nvd
References

Type at least two characters.

navigate open esc dismiss