CVE-2026-12815: Coolify 4.0.0 RCE Vulnerability

CVE-2026-12815 Overview

CVE-2026-12815 is an OS command injection vulnerability in Coollabsio Coolify version 4.0.0. The flaw exists in the Image Name Handler component, where unsanitized input flows into a shell context. An authenticated remote attacker with low privileges can manipulate the image name parameter to execute arbitrary operating system commands. The vendor did not respond to disclosure attempts. The changelog for Coolify 4.1.2 references improved validation for image, branch, proxy, and deployment inputs, indicating the issue was addressed in a subsequent release. The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command).

Critical Impact
Authenticated remote attackers can inject operating system commands through the Docker image name field, leading to command execution within the Coolify host context.

Affected Products

Coollabsio Coolify 4.0.0
Image Name Handler component
Self-hosted Coolify deployments prior to 4.1.2

Discovery Timeline

2026-06-22 - CVE-2026-12815 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-12815

Vulnerability Analysis

Coolify is an open-source, self-hostable platform for deploying applications and managing Docker workloads. The vulnerability resides in the Image Name Handler, the component responsible for processing user-supplied Docker image references during deployment workflows. The handler passes image name input into a shell command without proper neutralization of metacharacters.

An authenticated user with deployment privileges can supply a crafted image name that includes shell metacharacters such as backticks, semicolons, or command substitution sequences. When Coolify constructs the underlying docker command, the malicious payload is interpreted by the shell, resulting in execution of attacker-controlled commands. This grants attackers a foothold on the Coolify host with the privileges of the Coolify process.

Root Cause

The root cause is improper neutralization of special elements in command construction, mapped to [CWE-77]. The image name parameter is concatenated into a shell-invoked command rather than passed as a discrete argument to a process API. This pattern allows shell interpretation of user input, enabling injection of arbitrary commands.

Attack Vector

The attack is performed remotely over the network and requires authenticated access with permissions to define or trigger deployments. No user interaction is needed. The attacker submits a Docker image reference containing shell injection payloads through the Coolify management interface or API. The malicious payload executes when Coolify invokes Docker to pull or run the referenced image. Refer to the GitHub vulnerability reference and VulDB entry for CVE-2026-12815 for technical proof-of-concept details.

Detection Methods for CVE-2026-12815

Indicators of Compromise

Docker image name strings containing shell metacharacters such as ;, |, &&, $(), or backticks in Coolify deployment logs.
Unexpected child processes spawned by the Coolify service that are not standard docker invocations.
Outbound network connections from the Coolify host to unfamiliar destinations following a deployment event.
New cron jobs, SSH keys, or shell history entries on the Coolify host without administrative attribution.

Detection Strategies

Inspect Coolify application logs and deployment records for image references that deviate from expected registry/namespace/image:tag syntax.
Monitor process execution telemetry on the Coolify host for shell interpreters (/bin/sh, /bin/bash) spawned as children of the Coolify or Docker process tree.
Correlate authenticated Coolify API requests with subsequent anomalous process or network activity on the host.

Monitoring Recommendations

Enable command-line auditing on Linux hosts running Coolify using auditd or equivalent process telemetry collection.
Forward Coolify deployment logs and host process events to a centralized SIEM for correlation and retention.
Alert on any deployment-triggered execution of binaries outside an allowlist of expected tools (docker, git, curl).

How to Mitigate CVE-2026-12815

Immediate Actions Required

Upgrade Coolify to version 4.1.2 or later, which the vendor changelog indicates includes improved image, branch, proxy, and deployment input validation.
Restrict access to the Coolify management interface to trusted administrators and place it behind a VPN or authenticated reverse proxy.
Audit existing Coolify user accounts and revoke deployment privileges from accounts that do not require them.
Review recent deployment history for image name entries containing unexpected shell metacharacters.

Patch Information

Upgrade to Coolify 4.1.2 or later. The vendor changelog for 4.1.2 references improvements to input validation across image, branch, proxy, and deployment fields. The vendor did not formally respond to the disclosure, so administrators should validate the fix in their environment after upgrading.

Workarounds

Limit the set of users permitted to create or modify deployments until the upgrade is applied.
Run the Coolify service under a dedicated low-privilege account and constrain its filesystem and network access.
Place the Coolify host within a segmented network zone to limit lateral movement opportunities if command injection succeeds.
Implement an upstream web application firewall rule that rejects image name parameters containing shell metacharacters.

bash

# Example: upgrade Coolify to a patched release
cd /data/coolify
git pull
./upgrade.sh

# Verify installed version is 4.1.2 or later
docker exec coolify cat /var/www/html/VERSION