What is the CVSS score of CVE-2026-42143?

CVE-2026-42143 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Coolify are affected by CVE-2026-42143?

Coolify, a self-hosted infrastructure management platform, contains a privilege escalation vulnerability affecting versions prior to 4.0.0-beta.471 that allows authenticated low-privileged members to…. A patch is available.

How to fix or mitigate CVE-2026-42143?

24 hours: Audit all Coolify deployments for version status and restrict low-privileged user access to volume management functions. 7 days: Upgrade all Coolify instances to version 4.0.0-beta.471 or later; validate upgrade completion and test volume operations. 30 days: Implement role-based access controls to limit volume and infrastructure operations to designated administrators; conduct user permission audit against least-privilege policy.

Coolify CVE-2026-42143

EUVD-2026-41993 HIGH

OS Command Injection (CWE-78)

2026-07-07 GitHub_M

Command Injection Coolify

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable UI/API with low-complexity injection needing an authenticated member (PR:L), no user interaction, yielding root command execution for full C/I/A impact; scope kept U to match the vulnerable managed host.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 07, 2026 - 05:01 EUVD

Analysis Generated

Jul 07, 2026 - 03:52 vuln.today

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, user-controlled persistent volume names are interpolated into shell commands executed on managed servers without escaping or validation, allowing an authenticated member to inject shell metacharacters and execute commands as root when volume operations are triggered. This issue appears to be fixed in version 4.0.0-beta.471.

AnalysisAI

OS command injection in Coolify (self-hosted server/application/database management platform) versions prior to 4.0.0-beta.471 allows an authenticated low-privileged member to run arbitrary commands as root on managed servers by embedding shell metacharacters in persistent volume names, which are interpolated unescaped into shell commands during volume operations. The CVSS 3.1 score is 8.8 (High) with a network vector requiring only low privileges. No public exploit identified at time of analysis; an upstream fix commit and a tagged patched release exist.

Technical ContextAI

Coolify is an open-source, self-hostable Platform-as-a-Service (a Heroku/Netlify alternative) that orchestrates Docker containers, applications, and databases across one or more managed servers, typically issuing commands over SSH with root-level privileges on those targets. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): user-supplied persistent volume names are concatenated directly into shell command strings (e.g. docker volume operations) without escaping or allow-list validation, so metacharacters such as ;, |, $(), backticks, or & break out of the intended argument and are executed by the shell. The single affected product is coollabsio/coolify (CPE cpe:2.3:a:coollabsio:coolify), and because volume operations run in Coolify's privileged execution context, injected commands run as root on the managed host.

RemediationAI

Upgrade to the vendor-released patched version 4.0.0-beta.471 or later (fix commit d2064dd4998694cda2eabd00149f7c4d1e94c699), per advisory GHSA-6pmw-6m96-4v4m (https://github.com/coollabsio/coolify/security/advisories/GHSA-6pmw-6m96-4v4m) and release https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471. If you cannot patch immediately, reduce exposure by restricting who holds member accounts and removing untrusted or unnecessary team members, since exploitation requires an authenticated member - the trade-off is reduced collaboration. As an interim control, avoid creating or modifying persistent volumes through affected accounts and audit existing volume names for shell metacharacters, and place the Coolify dashboard behind network restrictions (VPN/allow-listed IPs) so only trusted operators can reach the UI/API; note these are stopgaps that do not fix the underlying unescaped interpolation and should not substitute for upgrading.