Coolify EUVD-2026-41995

Exploitation requires an authenticated Coolify account that is a member of the target team but holds only low privileges (PR:L) - no administrator or terminal-authorized role is needed, and no user interaction is required. The specific precondition is reaching the terminal websocket bootstrap routes, which enforce authentication but not terminal authorization; any team with at least one under-privileged member is exposed on all versions before 4.0.0-beta.471. Limiting factors: the attacker must already possess valid team credentials (so this is not anonymous/unauthenticated exploitation) and must be able to reach the Coolify web/websocket endpoint over the network; instances with strictly vetted team membership or network-isolated management interfaces are correspondingly harder to attack.

The signals align toward genuine high priority. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.9 critical) indicates network-reachable, low-complexity exploitation requiring only a low-privileged (already-provisioned team member) account and no user interaction, with a scope change and full confidentiality, integrity, and availability impact - consistent with obtaining command execution on managed servers. The one meaningful barrier is PR:L: the attacker must already be a member of the target team, so this is a privilege-escalation / insider-or-compromised-account risk rather than fully anonymous internet exploitation. EPSS and SSVC data were not provided in the input, so exploitation-probability and automatable/technical-impact framework values cannot be cited. There is no CISA KEV listing and no public proof-of-concept in the provided references, so this is not confirmed as actively exploited; the risk is driven by severity and ease of exploitation for anyone with even minimal team access, not by observed in-the-wild activity.

A user holding only a basic role in a Coolify team crafts a websocket connection directly to a terminal bootstrap route that they were never granted terminal access to. Because the route checks only that they are logged in, the connection succeeds and they run shell commands on the team's managed servers - reading secrets, altering deployments, or pivoting into the host. The low attack complexity (AC:L) and lack of required user interaction make this straightforward for any authenticated insider or an attacker who has phished a low-privilege account.