CVE-2026-27955 Overview
Coolify is an open-source, self-hostable platform for managing servers, applications, and databases. CVE-2026-27955 is a command injection vulnerability [CWE-78] in the executeInDocker() helper function. Versions prior to 4.0.0-beta.464 wrap commands in bash -c '{$command}' without escaping single quotes. Attackers with high privileges can inject shell metacharacters through the docker_compose_custom_build_command and docker_compose_custom_start_command fields. Successful exploitation executes arbitrary commands on the managed server host, breaking out of the intended Docker container context. The maintainers fixed the flaw in release 4.0.0-beta.464.
Critical Impact
Authenticated attackers can escape the Docker container boundary and execute arbitrary shell commands directly on the Coolify host.
Affected Products
- Coolify versions prior to 4.0.0-beta.464
- Self-hosted Coolify deployments managing Docker Compose stacks
- Coolify instances exposing the custom build or start command configuration
Discovery Timeline
- 2026-06-30 - CVE-2026-27955 published to NVD
- 2026-06-30 - Last updated in NVD database
Technical Details for CVE-2026-27955
Vulnerability Analysis
The vulnerability resides in the executeInDocker() helper, which constructs shell commands using string interpolation. The helper wraps user-supplied values inside single quotes with the pattern bash -c '{$command}'. Because single quotes inside the interpolated value are not escaped, an attacker can close the quoted context and append arbitrary shell commands.
Two user-controlled configuration fields feed into this helper: docker_compose_custom_build_command and docker_compose_custom_start_command. Coolify treats these fields as free-form command strings intended to run inside a container. However, because injection occurs before command execution, the payload runs in the parent shell context on the managed host.
The issue is classified as OS Command Injection under [CWE-78]. Exploitation requires authenticated access with permission to modify application configuration.
Root Cause
The root cause is unsafe command construction through string interpolation. The executeInDocker() helper does not sanitize or escape single quote characters before embedding user input inside the bash -c '...' argument. Any single quote in the input terminates the shell literal early, allowing subsequent characters to be parsed as shell syntax.
Attack Vector
An authenticated user with the ability to edit Docker Compose custom command fields submits a payload containing a single quote followed by shell metacharacters. When Coolify invokes the affected helper, the crafted string breaks out of the bash -c argument and executes attacker-controlled commands on the host operating system. Because the process runs outside the container sandbox, the attacker gains code execution in the Coolify management context rather than inside the target application container.
See the GitHub Security Advisory GHSA-6h8g-wpxp-cq98 for additional technical detail.
Detection Methods for CVE-2026-27955
Indicators of Compromise
- Unexpected shell processes spawned as children of the Coolify server process outside container namespaces.
- Audit log entries showing modifications to docker_compose_custom_build_command or docker_compose_custom_start_command containing single quotes or shell metacharacters.
- Outbound network connections from the Coolify host to unfamiliar destinations shortly after build or deploy events.
Detection Strategies
- Review Coolify application configurations for custom build or start command values containing ', ;, |, &&, `, or $( sequences.
- Correlate deployment events with host-level process execution telemetry to identify commands that did not originate from a container runtime.
- Enable and monitor Linux auditd rules for execve calls invoking bash -c from the Coolify service account.
Monitoring Recommendations
- Alert on new or modified custom compose command fields via database or API audit logs.
- Baseline the expected process tree of the Coolify service and flag deviations.
- Forward Coolify application and host logs to a centralized analytics platform for cross-source correlation.
How to Mitigate CVE-2026-27955
Immediate Actions Required
- Upgrade Coolify to version 4.0.0-beta.464 or later without delay.
- Audit all existing applications for suspicious values in docker_compose_custom_build_command and docker_compose_custom_start_command.
- Rotate credentials, API tokens, and SSH keys stored on the Coolify host if compromise is suspected.
- Restrict administrative access to Coolify to trusted users only.
Patch Information
The vulnerability is fixed in Coolify 4.0.0-beta.464. The patch escapes single quotes in the executeInDocker() helper so user-supplied command fragments cannot break out of the bash -c quoted argument. Refer to the GitHub Security Advisory GHSA-6h8g-wpxp-cq98 for release details.
Workarounds
- Limit the set of accounts permitted to edit application configuration fields until the upgrade is applied.
- Temporarily remove or blank out custom build and start command values on production applications.
- Place the Coolify management interface behind network controls that restrict access to trusted administrators only.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
