CVE-2026-27957: Coolify Command Injection RCE Vulnerability

CVE-2026-27957 Overview

Coolify is an open-source, self-hostable platform for managing servers, applications, and databases. CVE-2026-27957 is an authenticated command injection vulnerability [CWE-78] in the CA Certificate management feature. Any authenticated user can execute arbitrary commands as the configured SSH user on the managed server host. Because Coolify typically requires the SSH user to be root or a member of the docker group, successful exploitation results in complete compromise of the managed server and all associated Docker containers. The vulnerability affects Coolify versions prior to 4.0.0-beta.464 and is fixed in that release.

Critical Impact
Authenticated attackers gain full command execution as a privileged SSH user, leading to takeover of the Coolify-managed host and every Docker container it operates.

Affected Products

Coolify versions prior to 4.0.0-beta.464
Self-hosted Coolify deployments exposing the web interface to authenticated users
Managed server hosts and Docker containers under Coolify control

Discovery Timeline

2026-06-30 - CVE-2026-27957 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-27957

Vulnerability Analysis

The vulnerability resides in the CA Certificate management feature of Coolify. User-supplied input tied to certificate handling flows into a shell command that Coolify executes on the managed server host over SSH. Because the input is not properly sanitized or parameterized, an authenticated user can inject shell metacharacters and append arbitrary commands.

The injected commands run under the SSH user configured for the managed server. Coolify's operating model requires this account to be root or a member of the docker group so it can orchestrate containers. As a result, command injection translates directly into privileged code execution on the host and container escape via the Docker socket.

The attack requires authentication but no user interaction. Any user with access to the Coolify interface, including low-privilege team members, can trigger the flaw and reach the managed host.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The CA Certificate management workflow concatenates user-controlled data into a shell command string executed over SSH, rather than passing arguments through a safe execution API or validating input against a strict allowlist.

Attack Vector

An authenticated Coolify user submits a crafted payload through the CA Certificate management feature. The payload contains shell metacharacters such as ;, &&, |, or backticks that break out of the intended command context. Coolify then executes the composed command on the target host over SSH, running the attacker's commands with the privileges of the SSH user. See the GitHub Security Advisory GHSA-7g97-c4xv-3cjx for technical details.

Detection Methods for CVE-2026-27957

Indicators of Compromise

Unexpected shell processes spawned by the Coolify SSH user on managed hosts, especially child processes of certificate-handling routines
New or modified files under Docker volume mount points or /root/ created outside normal deployment windows
Outbound network connections from managed hosts to unfamiliar destinations shortly after CA certificate operations
Unauthorized Docker container creation, image pulls, or modifications to running containers

Detection Strategies

Review Coolify application and audit logs for CA Certificate management actions that include shell metacharacters (;, |, &, `, $() in submitted fields
Correlate SSH session activity on managed hosts with Coolify user actions to spot commands that do not match legitimate orchestration patterns
Monitor for anomalous use of the Docker socket or docker CLI by the Coolify SSH account

Monitoring Recommendations

Enable verbose auditing on managed hosts using auditd or equivalent to record process execution by the Coolify SSH user
Ship Coolify web application logs and host process telemetry into a centralized SIEM or data lake for correlation
Alert on any interactive shell (bash, sh) spawned from Coolify's SSH command execution path

How to Mitigate CVE-2026-27957

Immediate Actions Required

Upgrade all Coolify instances to version 4.0.0-beta.464 or later without delay
Audit Coolify user accounts and remove any that are unnecessary or unrecognized
Review recent CA Certificate management activity and SSH command history on managed hosts for signs of exploitation
Rotate SSH keys, Coolify secrets, and any credentials stored on managed hosts if compromise is suspected

Patch Information

The vulnerability is fixed in Coolify 4.0.0-beta.464. Refer to the Coolify GitHub Security Advisory GHSA-7g97-c4xv-3cjx for release details and upgrade instructions.

Workarounds

Restrict access to the Coolify web interface using network-level controls such as a VPN or IP allowlist until patching is complete
Limit Coolify user registration and reduce the number of accounts with access to CA Certificate management
Where feasible, run the Coolify SSH user with the minimum privileges required and avoid granting root where a scoped docker group account suffices

bash

# Configuration example: restrict Coolify web UI to trusted networks via UFW
sudo ufw default deny incoming
sudo ufw allow from 10.0.0.0/8 to any port 8000 proto tcp
sudo ufw allow from 192.168.0.0/16 to any port 8000 proto tcp
sudo ufw enable