PT-2026-56145 · Coolify · Coolify

Published 2026-07-07 · Updated 2026-07-07 · CVE-2026-42201

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.474

Description Database credential fields are validated only as strings at the API layer without shell-safety checks. These values are interpolated directly into Docker Compose YAML commands without escaping, which can lead to command injection. The affected variables include redis password, keydb password, dragonfly password, clickhouse admin user, clickhouse admin password, postgres user, and mysql user.

Recommendations Update to version 4.0.0-beta.474.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-42201

Affected Products

Coolify

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-42201 · Security Note
• https://github.com/coollabsio/coolify/pull/9676 · Note
• https://github.com/coollabsio/coolify/security/advisories/GHSA-f35h-g2c2-q36v · Note
• https://github.com/coollabsio/coolify/commit/bff6d853708f3d7c861279586f107739036e67da · Note
• https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.474 · Note
• https://twitter.com/infoflowcloud/status/2074366838880841752 · Twitter Post
• https://twitter.com/CVEnew/status/2074365814203969765 · Twitter Post