Coolify CVE-2026-27957

Requires an authenticated Coolify account (PR:L) with access to the CA Certificate management feature, and at least one server managed by Coolify whose configured SSH user is root or in the docker group - which is Coolify's documented/intended setup, so it is effectively the default operational condition. No user interaction is needed (UI:N) and the attack is fully network-reachable (AV:N) against the Coolify web interface. The principal limiting factor is the need for valid credentials: instances with a single trusted operator and no untrusted accounts face lower practical risk than multi-user or publicly registrable deployments.

Signals are largely consistent and point to genuine priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity attack requiring only a low-privileged authenticated account and no user interaction, with total confidentiality, integrity, and availability impact. The mitigating factor is PR:L - an attacker needs valid Coolify credentials, so this is most dangerous on shared/multi-tenant instances or where account credentials can be obtained. No EPSS score, KEV listing, or POC reference is provided in the input, so probabilistic exploitation likelihood and active-exploitation status are UNKNOWN rather than confirmed-low; absence of these signals should not be read as low risk given how trivially injection-class bugs are weaponized once an advisory is public. SSVC framework data (exploitation, automatable, technical impact) was not provided.

An attacker with any valid Coolify account (or who has phished/compromised low-privilege credentials) navigates to the CA Certificate management feature and submits a certificate input crafted to embed a shell metacharacter payload. When Coolify processes it over SSH to a managed host, the injected command runs as the root/docker-group SSH user, giving the attacker a shell on the host and control of all containers. No public POC is referenced, but the low attack complexity (AC:L) means a working exploit is straightforward to develop from the advisory.