What is the CVSS score of CVE-2026-27957?

CVE-2026-27957 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Coolify are affected by CVE-2026-27957?

Coolify, a server management platform, contains a high-severity authenticated command injection flaw in its CA Certificate management feature that allows any logged-in user to execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-27957?

Within 24 hours: Inventory all Coolify deployments, document installed versions, and identify which SSH user accounts and managed servers are at risk. Within 7 days: Restrict Coolify login access to essential administrators only; implement network monitoring for suspicious CA Certificate management activity; subscribe to vendor advisory channels for patch availability. Within 30 days: Apply vendor-released patch immediately upon publication to all instances; audit access logs for any exploitation attempts during the interim period.

Coolify CVE-2026-27957

EUVD-2026-40334 HIGH

OS Command Injection (CWE-78)

2026-06-30 GitHub_M

Command Injection Docker Coolify

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable web feature (AV:N) with trivial injection (AC:L) needs a low-privileged authenticated account (PR:L), no interaction (UI:N), and yields full host compromise (C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 30, 2026 - 16:01 EUVD

Analysis Generated

Jun 30, 2026 - 15:22 vuln.today

CVE Published

Jun 30, 2026 - 14:39 cve.org

HIGH 8.8

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, an authenticated command injection vulnerability in the CA Certificate management feature allows any authenticated user to execute arbitrary commands as the configured SSH user on the managed server host. As the SSH user typically would have to either be root or part of the docker group for Coolify to function as intended, this provides complete compromise of the managed server and associated docker containers. This vulnerability is fixed in 4.0.0-beta.464.

AnalysisAI

Authenticated command injection in Coolify's CA Certificate management feature (all versions prior to 4.0.0-beta.464) lets any logged-in user inject arbitrary OS commands that execute as the configured SSH user on a managed server. Because Coolify requires that SSH user to be root or a docker-group member, successful exploitation yields full compromise of the managed host and every Docker container it runs. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a high-priority patch for any multi-user Coolify instance.

Technical ContextAI

Coolify is a self-hostable PaaS (an open-source alternative to Heroku/Netlify) that orchestrates servers, applications, and databases over SSH and Docker. The flaw is a classic OS Command Injection (CWE-78): user-controlled input in the CA Certificate management workflow is passed into a shell context on the target host without adequate sanitization or argument isolation. Coolify executes management actions by SSH-ing into managed servers as a privileged account, so the injected command inherits that account's rights. The single affected product per CPE is cpe:2.3:a:coollabsio:coolify, and the tags (Docker, Command Injection) confirm the root cause is shell-level injection in a Docker-centric control plane.

RemediationAI

Vendor-released patch: 4.0.0-beta.464 - upgrade all Coolify instances to 4.0.0-beta.464 or later as the primary fix, following the GitHub Security Advisory at https://github.com/coollabsio/coolify/security/advisories/GHSA-7g97-c4xv-3cjx. If immediate patching is not possible, reduce exposure by tightly restricting who holds authenticated Coolify accounts and removing or disabling non-essential low-privilege users, since exploitation requires authentication; avoid using the CA Certificate management feature until patched. As a defense-in-depth trade-off, consider running the managed-server SSH user with the least privilege Coolify can tolerate (note that Coolify documents needing root or docker-group membership, so de-privileging may break orchestration functionality), and network-restrict the Coolify web UI to trusted management networks/VPN to limit who can reach the vulnerable endpoint at all.