Coolify CVE-2026-42153

Exploitation requires an authenticated Coolify account (CVSS PR:L) with the ability to create or configure a PostgreSQL database resource, because the injection point is the attacker-controlled postgres_user and postgres_db settings used in the healthcheck command. The specific precondition is that the attacker can set these database configuration fields and that the instance runs a version prior to 4.0.0-beta.474 where healthcheck commands are built in shell form. Limiting factors: it is NOT unauthenticated (a valid, sufficiently privileged panel user is needed), so single-operator/trusted-admin-only deployments face little real risk, while multi-tenant instances or those granting database-management rights to untrusted users are directly exposed; code execution is confined to the PostgreSQL database container (scope unchanged, S:U) rather than the Coolify host.

The vendor-assigned CVSS 3.1 score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding full compromise of the targeted database container. The PR:L metric is the key limiter: this is not an unauthenticated flaw - the attacker must already hold a valid Coolify account with permission to define or edit a PostgreSQL resource. No EPSS score was supplied in the input, so exploitation probability cannot be quantified here, and no SSVC decision was provided. The vulnerability is not in CISA KEV and no POC was referenced, so this is best treated as a high-severity-but-not-yet-exploited issue: a genuine priority for any multi-tenant or internet-exposed Coolify deployment where untrusted users have panel access, but lower urgency for single-operator instances where the only authenticated user is already the administrator. No conflicting signals were observed between the CVSS vector and the description - both consistently point to authenticated, network-facing exploitation.

An attacker with a low-privileged but valid Coolify account creates or edits a PostgreSQL database and sets the postgres_user or postgres_db field to a value embedding shell metacharacters (for example, a name containing a command-substitution or a chained command). When Coolify generates and runs the container healthcheck in shell form, the injected payload executes inside the database container as its runtime user. Given AV:N/AC:L, this requires only routine panel interaction and no special timing or victim action; no public POC was referenced in the source data.