CVE-2026-84694: Coolify before 4.2.0 Remote Code Execution via Environment Variable Key
Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the server host outside containers.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Coolify deployments using versions before 4.2.0 that execute Docker commands over SSH on managed servers are exposed. The impact is on the managed server host, not only on workloads running inside containers.
What does an attacker need to exploit it?
An attacker needs authentication and the ability to supply an environment variable key name containing shell metacharacters. No user interaction is required.
Are default deployments known to be affected?
The available information identifies affected versions and the SSH-managed-server Docker command path, but does not state whether this path is enabled or reachable in a default deployment.
What can be done if upgrading is not immediately possible?
Restrict access to accounts that can create or modify environment variable keys, and prevent untrusted users from supplying such keys. Review environment variable key names for shell metacharacters, especially on applications deployed to managed servers.