CVE-2026-27957
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk47th percentile — higher than 47% of all known CVEs
Summary
In Coolify prior to version 4.0.0-beta.464, an authenticated command injection vulnerability in the CA Certificate management feature allows any authenticated user to execute arbitrary commands as the configured SSH user on the managed server host.
Risk Assessment
An attacker can gain complete control over the managed server and associated Docker containers, compromising the confidentiality, integrity, and availability of data and services.
Recommendation
Immediately update Coolify to version 4.0.0-beta.464 or later, which contains a fix for this vulnerability.
Original NVD description (English source)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, an authenticated command injection vulnerability in the CA Certificate management feature allows any authenticated user to execute arbitrary commands as the configured SSH user on the managed server host. As the SSH user typically would have to either be root or part of the docker group for Coolify to function as intended, this provides complete compromise of the managed server and associated docker containers. This vulnerability is fixed in 4.0.0-beta.464.