PT-2026-56137 · Coolify · Coolify

Published 2026-07-07 · Updated 2026-07-07 · CVE-2026-42143

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.471

Description Coolify is an open-source tool for managing servers, applications, and databases. An authenticated member can execute commands as root on managed servers by injecting shell metacharacters into persistent volume names. This occurs because these user-controlled names are interpolated into shell commands without proper escaping or validation when volume operations are triggered.

Recommendations Update to version 4.0.0-beta.471.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-42143

Affected Products

Coolify

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-42143 · Security Note
• https://github.com/coollabsio/coolify/security/advisories/GHSA-6pmw-6m96-4v4m · Note
• https://github.com/coollabsio/coolify/commit/d2064dd4998694cda2eabd00149f7c4d1e94c699 · Note
• https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471 · Note
• https://twitter.com/CVEnew/status/2074365824026939894 · Twitter Post
• https://twitter.com/infoflowcloud/status/2074366909315776635 · Twitter Post