PT-2026-53893 · Coolify · Coolify

Published 2026-06-30 · Updated 2026-06-30 · CVE-2026-27957

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.464

Description An authenticated command injection issue exists in the CA Certificate management feature. This allows an authenticated user to execute arbitrary commands as the configured SSH user on the managed server host. Since the SSH user typically requires root privileges or membership in the docker group for the software to function, this can lead to a complete compromise of the managed server and its associated docker containers.

Recommendations Update to version 4.0.0-beta.464.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-27957

Affected Products

Coolify

References · 3

• 🔥 https://github.com/coollabsio/coolify/security/advisories/GHSA-7g97-c4xv-3cjx · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-27957 · Security Note
• https://twitter.com/VulmonFeeds/status/2071991807475376602 · Twitter Post