CVE-2026-42201: Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, database credential fields (redispassword, keydbpassword, dragonflypassword, clickhouseadminuser, clickhouseadminpassword, postgresuser, mysqluser) are validated only as 'string' at the API layer, with zero shell-safety checks. These values are then interpolated directly into Docker Compose YAML command: strings without any escaping. This issue is fixed in version 4.0.0-beta.474.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Coolifyto a version that resolves this vulnerability.Fixed in 4.0.0-beta.474
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42201?
CVE-2026-42201 has a severity rating of low, specifically rated at 3.3.
What vulnerability does CVE-2026-42201 describe?
CVE-2026-42201 describes an OS Command Injection vulnerability in Coolify related to database credential fields.
How do I fix CVE-2026-42201?
To fix CVE-2026-42201, upgrade to Coolify version 4.0.0-beta.474 or later, where the issue has been addressed.
What are the affected database credential fields in CVE-2026-42201?
The affected database credential fields include redis_password, keydb_password, dragonfly_password, clickhouse_admin_user, clickhouse_admin_password, postgres_user, and mysql_user.
Who is affected by CVE-2026-42201?
Users of prior Coolify versions before 4.0.0-beta.474 that utilize the specified database credential fields are at risk due to CVE-2026-42201.