Command Injection Vulnerability in Coolify

Coolify versions prior to 4.2.0 contain a critical vulnerability identified as CVE-2026-84694. The flaw exists in how the application handles environment variable key names when constructing Docker commands for execution over SSH on managed host servers. Specifically, the application fails to properly sanitize or escape input, enabling an authenticated attacker to inject shell metacharacters into the environment variable key fields. When Coolify triggers a Docker command (such as 'docker run' or 'docker exec') using these unsanitized variables, the injected characters are interpreted by the host shell, resulting in arbitrary code execution outside the container context. This vulnerability poses a high risk to infrastructure security, as it allows escalation from the Coolify application interface to full host-level access on connected managed servers.

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary commands on the host server where Coolify manages Docker containers. This effectively grants the attacker control over the host operating system, potentially leading to unauthorized data access, persistence, privilege escalation, and lateral movement within the infrastructure.

Recommendation

Prioritize the immediate upgrade of all Coolify instances to version 4.2.0 or later to remediate CVE-2026-84694. For infrastructure hardening, restrict the permissions of the SSH service account used by Coolify to communicate with managed hosts, applying the principle of least privilege to limit the scope of potential command injection impact.