CVE-2026-42153: Coolify Command Injection RCE Vulnerability

CVE-2026-42153 Overview

Coolify is an open-source, self-hostable platform for managing servers, applications, and databases. CVE-2026-42153 is a command injection vulnerability [CWE-78] in the PostgreSQL healthcheck command generation logic. Versions prior to 4.0.0-beta.474 construct healthcheck shell commands using attacker-controlled database settings, specifically postgres_user and postgres_db. An authenticated user can inject arbitrary commands that execute inside the database container. The maintainers released a fix in version 4.0.0-beta.474.

Critical Impact

An authenticated Coolify user can inject shell commands into the PostgreSQL container via database configuration fields, achieving code execution within the container context.

Affected Products

• Coolify versions prior to 4.0.0-beta.474
• PostgreSQL database services provisioned through Coolify
• Related database integrations sharing the same shell-form healthcheck pattern (ClickHouse, Dragonfly) per the upstream patch

Discovery Timeline

• 2026-07-06 - CVE-2026-42153 published to NVD
• 2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-42153

Vulnerability Analysis

Coolify generates Docker healthcheck definitions for provisioned databases. For PostgreSQL services, the healthcheck test field was built as a shell-form string that interpolated user-supplied values such as postgres_user and postgres_db. Because Docker executes shell-form healthchecks through /bin/sh -c, any shell metacharacters inside those values are interpreted by the shell rather than treated as literal arguments.

An authenticated user with permission to create or modify a PostgreSQL database resource can supply crafted values in these fields. When the container starts and the healthcheck runs, the injected payload executes inside the database container with the privileges of the healthcheck process. This grants the attacker command execution on the containerized database, exposing stored data, credentials mounted into the container, and network paths to other Coolify-managed services.

Root Cause

The root cause is unsafe string interpolation of untrusted input into a shell-form command. The healthcheck definition used PHP double-quoted string interpolation of database properties, so characters such as ;, &&, `, and $() were passed through to /bin/sh. The fix converts healthchecks to Docker exec-form arrays, where each argument is passed directly to execve and no shell parsing occurs.

Attack Vector

Exploitation requires an authenticated Coolify account with permissions to configure a database. The attacker sets postgres_user or postgres_db to a value containing shell metacharacters and a command payload. When Coolify (re)deploys the container, Docker evaluates the healthcheck through the shell and executes the injected command inside the PostgreSQL container.

// Vulnerable pattern (shell-form healthcheck with interpolated user input)
'healthcheck' => [
    'test' => "clickhouse-client --user {$this->database->clickhouse_admin_user} --password {$this->database->clickhouse_admin_password} --query 'SELECT 1'",
    'interval' => '5s',
    'timeout'  => '5s',
    'retries'  => 10,
],

// Patched pattern (exec-form healthcheck, arguments passed literally)
'healthcheck' => [
    'test' => ['CMD', 'clickhouse-client', '--user', (string) $this->database->clickhouse_admin_user,
              '--password', (string) $this->database->clickhouse_admin_password,
              '--query', 'SELECT 1'],
    'interval' => '5s',
    'timeout'  => '5s',
    'retries'  => 10,
],
// Source: https://github.com/coollabsio/coolify/commit/b74f54302b1a857c22c55fe1210d700859b0b3df

The same shell-form to exec-form conversion was applied to the Dragonfly healthcheck, which previously interpolated dragonfly_password into a redis-cli -a shell string. See the GitHub Security Advisory GHSA-gvc4-f276-r88p for the full advisory.

Detection Methods for CVE-2026-42153

Indicators of Compromise

• Database resources in Coolify whose postgres_user or postgres_db fields contain shell metacharacters such as ;, |, &&, backticks, or $().
• Unexpected child processes of the healthcheck command inside PostgreSQL containers, for example sh -c spawning curl, wget, nc, or bash.
• Outbound network connections from database containers to hosts not associated with normal replication or backup traffic.

Detection Strategies

• Audit the Coolify database configuration store for stored values in postgres_user, postgres_db, clickhouse_admin_user, and dragonfly_password that contain non-alphanumeric characters beyond _ and -.
• Review Docker inspect output for running containers and flag any Healthcheck.Test entries that still use shell-form (CMD-SHELL or single-string form) after upgrading.
• Correlate container process telemetry with healthcheck intervals to identify anomalous commands executing on the healthcheck cadence.

Monitoring Recommendations

• Log and alert on process creation events inside database containers where the parent is a healthcheck shell and the child is not the expected client binary.
• Monitor Coolify application audit logs for changes to database configuration fields by non-administrative accounts.
• Track egress traffic from database containers and alert on connections to unknown external endpoints.

How to Mitigate CVE-2026-42153

Immediate Actions Required

• Upgrade Coolify to version 4.0.0-beta.474 or later, which converts healthchecks to Docker exec-form arrays.
• Review all existing database resources for suspicious values in user-controlled fields and reset them to safe values before redeploying.
• Rotate credentials and secrets exposed to any PostgreSQL, ClickHouse, or Dragonfly container that may have been compromised.
• Restrict Coolify database configuration permissions to trusted administrators until the upgrade is complete.

Patch Information

The fix is included in Coolify release v4.0.0-beta.474 and delivered through pull request #9674. The remediation is implemented in commit b74f543, which replaces shell-form healthchecks with exec-form arrays across PostgreSQL, ClickHouse, and Dragonfly start actions.

Workarounds

• Temporarily restrict database creation and modification privileges to a small group of trusted operators until the patch is applied.
• Validate configuration inputs at the reverse proxy or WAF layer to reject values containing shell metacharacters in database fields.
• Redeploy affected database containers after upgrading to ensure the new exec-form healthcheck definitions are in place.

# Upgrade Coolify to the patched release
cd /data/coolify/source
git fetch --tags
git checkout v4.0.0-beta.474
./upgrade.sh

# Verify healthchecks are now in exec-form after redeploy
docker inspect <postgres_container> \
  --format '{{json .Config.Healthcheck.Test}}'
# Expected output begins with: ["CMD", "pg_isready", ...]