What is the CVSS score of CVE-2026-42153?

CVE-2026-42153 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Coolify are affected by CVE-2026-42153?

Coolify self-hosted PaaS versions prior to 4.0.0-beta.474 contain a high-severity command injection vulnerability that allows any authenticated database administrator to execute arbitrary operating…. A patch is available.

How to fix or mitigate CVE-2026-42153?

Within 24 hours: (1) Audit all users with Coolify database configuration privileges; (2) Revoke or disable non-essential database management access; (3) Enable audit logging for configuration changes. Within 7 days: (1) Review access logs for suspicious postgres_user or postgres_db parameter modifications; (2) Implement network segmentation around Coolify-managed containers; (3) Document current users with database configuration rights. Within 30 days: (1) Deploy Coolify 4.0.0-beta.474 or later when vendor patch becomes available; (2) Conduct forensic review if any unauthorized configuration changes detected; (3) Implement role-based access control limiting database configuration to authorized administrators.

Coolify CVE-2026-42153

EUVD-2026-41960 HIGH

OS Command Injection (CWE-78)

2026-07-06 GitHub_M

PostgreSQL Command Injection Coolify Coollabsio

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable panel, low complexity, requires an authenticated user able to set database config (PR:L), no interaction; injected commands fully compromise the database container (C/I/A:H, scope unchanged).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 06, 2026 - 23:01 EUVD

Analysis Generated

Jul 06, 2026 - 22:30 vuln.today

CVE Published

Jul 06, 2026 - 21:30 cve.org

HIGH 8.8

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL healthcheck command generation used attacker-controlled database settings (postgres_user and postgres_db) in shell-form commands, allowing an authenticated user to inject commands executed in the database container. This issue is fixed in version 4.0.0-beta.474.

Articles & Coverage 1

News 3 New PostgreSQL Vulnerabilities - 1 Critical, 2 High Severity Jul 07, 2026

AnalysisAI

Command injection in Coolify self-hosted PaaS versions prior to 4.0.0-beta.474 allows an authenticated user to run arbitrary OS commands inside the PostgreSQL database container by supplying malicious postgres_user or postgres_db values that are interpolated into shell-form healthcheck commands (CWE-78). Because the CVSS vector is PR:L/UI:N with full high impact to confidentiality, integrity, and availability, any user able to create or configure a database can achieve container-level code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Coolify is an open-source, self-hostable alternative to Heroku/Netlify/Vercel that provisions and manages servers, applications, and databases (typically via Docker containers). The flaw is a classic OS command injection (CWE-78): Coolify builds the PostgreSQL healthcheck command in shell form and concatenates user-controllable database settings - postgres_user and postgres_db - directly into that string without neutralizing shell metacharacters. When the healthcheck runs inside the database container, an attacker-supplied value such as a semicolon or command substitution is interpreted by the shell rather than treated as data. The affected component is coollabsio:coolify (CPE cpe:2.3:a:coollabsio:coolify:*), and the root cause is the use of shell-form command construction instead of exec-form argument arrays or proper escaping.

RemediationAI

Vendor-released patch: upgrade Coolify to version 4.0.0-beta.474 or later, which replaces the vulnerable shell-form healthcheck construction (see release https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.474 and advisory https://github.com/coollabsio/coolify/security/advisories/GHSA-gvc4-f276-r88p). If immediate upgrade to a beta build is not acceptable, reduce exposure by restricting who can create or edit PostgreSQL database resources - limit Coolify accounts and team membership to fully trusted operators, since exploitation requires an authenticated user able to set postgres_user/postgres_db; the trade-off is reduced self-service capability for tenants. Additionally, avoid exposing the Coolify management dashboard directly to the internet (place it behind a VPN or IP allowlist) to shrink the pool of potential authenticated attackers, accepting the operational overhead of gated access. Do not rely on input validation you cannot verify; the definitive fix is the upgrade.