CVE-2026-42148: Coolify RCE Vulnerability

CVE-2026-42148 Overview

CVE-2026-42148 is a command injection vulnerability [CWE-78] in Coolify, an open-source self-hostable platform for managing servers, applications, and databases. The flaw resides in the buildHelperImage method within app/Livewire/Settings/Index.php. The method constructs a Docker build command using the dev_helper_version field without shell escaping. An authenticated attacker who can set the helper version and trigger a helper image build in a development environment can execute arbitrary commands on the host. The issue is fixed in version 4.0.0-beta.474.

Critical Impact
Authenticated attackers with high privileges in a development environment can achieve arbitrary command execution on the Coolify host through the unescaped dev_helper_version parameter.

Affected Products

Coolify versions prior to 4.0.0-beta.474
Coolify self-hosted deployments with development environment access
Coolify installations exposing the Settings interface to privileged users

Discovery Timeline

2026-07-06 - CVE-2026-42148 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-42148

Vulnerability Analysis

The vulnerability exists in the buildHelperImage method of app/Livewire/Settings/Index.php. This method constructs a Docker build command string by concatenating the user-controllable dev_helper_version property directly into a shell command. No escaping or strict validation is applied before the value reaches the shell interpreter. When an operator sets the helper version and triggers the helper image build workflow, the injected payload executes with the privileges of the Coolify process. This results in arbitrary command execution on the underlying server.

Root Cause

The root cause is missing input sanitization on the dev_helper_version Livewire property. The original validation allowed a nullable string up to 50 characters with no character-class restriction. Because the value flows into a Docker build command executed through a shell, any metacharacter such as ;, &&, |, or backticks can break out of the argument context and execute additional commands.

Attack Vector

Exploitation requires local access to an authenticated, high-privilege Coolify session in a development environment. The attacker modifies the dev_helper_version setting to include shell metacharacters and a command payload, then triggers the helper image build. The build routine invokes the shell with the crafted string, resulting in command execution. User interaction is required to trigger the build, and attack complexity is high because the attacker must control the settings and initiate the build flow.

php

     #[Validate('required|string|timezone')]
     public string $instance_timezone;
 
-    #[Validate('nullable|string|max:50')]
+    #[Validate(['nullable', 'string', 'max:128', 'regex:/^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/'])]
     public ?string $dev_helper_version = null;
 
     public array $domainConflicts = [];

Source: GitHub Commit dc9322b. The patch replaces the permissive validator with a strict regular expression that restricts dev_helper_version to alphanumeric characters, underscores, dots, and hyphens, blocking shell metacharacters at the input layer.

Detection Methods for CVE-2026-42148

Indicators of Compromise

Unexpected child processes spawned by the Coolify PHP or Livewire worker processes, especially shell interpreters such as sh or bash.
Docker build invocations containing shell metacharacters (;, &&, |, backticks) in the --build-arg or version arguments.
Modifications to the dev_helper_version setting followed shortly by helper image build events in Coolify logs.

Detection Strategies

Review Coolify application logs for changes to the dev_helper_version field paired with build trigger events.
Monitor process ancestry on the Coolify host for shell commands descending from the Coolify service that are unrelated to normal build steps.
Inspect Docker daemon audit logs for build commands with anomalous tag or argument strings containing non-alphanumeric characters.

Monitoring Recommendations

Enable command-line auditing on the Coolify host and alert on shell invocations by the web application user.
Correlate settings-page HTTP requests with subsequent process execution events on the host.
Track file system writes and outbound network connections that immediately follow helper image build actions.

How to Mitigate CVE-2026-42148

Immediate Actions Required

Upgrade Coolify to version 4.0.0-beta.474 or later, which enforces strict validation on dev_helper_version.
Restrict access to the Coolify Settings interface to trusted administrators only.
Audit historical values of dev_helper_version and recent helper image build events for signs of tampering.

Patch Information

The fix is available in Coolify 4.0.0-beta.474. Details are published in the GitHub Security Advisory GHSA-x9qh-w4c4-54f9, the GitHub Pull Request #9670, and the remediation commit dc9322b. The patch tightens the Livewire validator on dev_helper_version to a maximum length of 128 characters and applies a regex allowlist limiting input to [A-Za-z0-9_.-].

Workarounds

Disable or avoid using development environments on internet-exposed Coolify instances until the patch is applied.
Limit the number of accounts with permission to modify instance settings and trigger helper image builds.
Run the Coolify service under a dedicated low-privilege user with restricted shell and Docker socket access to reduce the blast radius of any command execution.

bash

# Verify installed Coolify version and upgrade if below the patched release
docker exec coolify sh -c 'cat /var/www/html/config/version.php'

# Pull and apply the fixed release
curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash -s -- --version 4.0.0-beta.474