CVE-2026-84694: Coolify RCE Vulnerability via SSH Commands

CVE-2026-84694 Overview

Coolify versions before 4.2.0 contain a command injection vulnerability in how the platform handles Docker commands executed over SSH on managed servers. The application fails to properly escape environment variable key names before passing them to shell commands. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the underlying server host, breaking out of container boundaries. The flaw is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
Authenticated attackers can achieve remote code execution on Coolify-managed server hosts, escaping container isolation and compromising the entire deployment infrastructure.

Affected Products

Coolify versions prior to 4.2.0
Self-hosted Coolify deployments managing remote servers via SSH
Coolify Docker orchestration components handling environment variables

Discovery Timeline

2026-09-02 - CVE-2026-84694 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84694

Vulnerability Analysis

Coolify is an open-source, self-hosted platform for deploying applications and databases on remote servers managed over SSH. The platform allows users to configure environment variables for their applications, which are subsequently passed to Docker commands executed on managed hosts.

The vulnerability resides in the code path that constructs Docker CLI invocations containing user-supplied environment variable key names. Coolify sanitizes environment variable values but does not apply the same rigor to key names. As a result, shell metacharacters embedded in a key name are interpreted by the remote shell rather than treated as literal data.

Because Coolify executes these commands over SSH on the managed server, successful injection yields code execution on the host operating system outside any container sandbox. This gives attackers control over the Docker daemon, mounted volumes, secrets, and adjacent workloads.

Root Cause

The root cause is insufficient input validation on environment variable key names within the application logic. The validation patterns defined in app/Support/ValidationPatterns.php and authorization checks in app/Policies/ApplicationPolicy.php permit characters that carry semantic meaning inside a shell context. When key names are concatenated into a Docker command string and executed via SSH, the shell interprets characters such as backticks, $(), semicolons, and pipes as command boundaries.

Attack Vector

An authenticated user with permission to define or modify application environment variables submits a crafted key name containing shell metacharacters. When Coolify deploys or restarts the application, the malicious key is embedded into a Docker command executed over SSH on the target server. The shell parses the injected payload and runs arbitrary commands under the SSH user context on the managed host.

Code-level details of the fix are available in the upstream patch. See GitHub Commit b50839d4 and the VulnCheck Advisory for Coolify for technical analysis of the vulnerable code path.

Detection Methods for CVE-2026-84694

Indicators of Compromise

Environment variable keys containing shell metacharacters such as `, $(, ;, |, &, or \n stored in the Coolify database.
Unexpected child processes of the SSH session or Docker CLI on managed servers, spawning shells, network utilities, or package managers.
Outbound network connections from managed hosts to attacker-controlled infrastructure shortly after application deployment or restart events.
Modifications to ~/.ssh/authorized_keys, cron entries, or systemd units on managed hosts that correlate with Coolify deploy actions.

Detection Strategies

Audit the Coolify database for application environment variable keys that do not match a strict [A-Z_][A-Z0-9_]* pattern.
Correlate Coolify deployment events with process execution telemetry on managed servers to surface anomalous command chains launched under the SSH user.
Monitor Docker daemon and SSH logs for command strings containing unexpected shell metacharacters passed as -e or --env arguments.

Monitoring Recommendations

Enable process auditing (auditd on Linux) on all Coolify-managed hosts and forward events to a central SIEM.
Alert on SSH sessions from the Coolify controller that spawn non-Docker binaries such as curl, wget, bash -i, nc, or python.
Track file integrity on critical paths including /etc/cron.*, /etc/systemd/system/, and user SSH directories on managed servers.

How to Mitigate CVE-2026-84694

Immediate Actions Required

Upgrade Coolify to version 4.2.0 or later on all controller instances without delay.
Rotate SSH keys, API tokens, and application secrets stored in Coolify after patching, assuming compromise until proven otherwise.
Review all application environment variable keys for suspicious characters and remove or rename entries that violate a strict naming policy.
Restrict access to the Coolify web interface to trusted operators and enforce multi-factor authentication on all accounts.

Patch Information

The vulnerability is fixed in Coolify release v4.2.0. The corrective changes are included in GitHub Commit b50839d4, which tightens validation of environment variable key names to reject shell metacharacters before they reach Docker command construction. Administrators should follow the upstream upgrade instructions in the Coolify repository.

Workarounds

If upgrading immediately is not feasible, restrict environment variable management to a small set of trusted administrators via Coolify role-based access controls.
Manually validate all environment variable keys against a strict allow-list regex such as ^[A-Z_][A-Z0-9_]*$ before saving.
Isolate managed servers on a dedicated network segment and limit outbound egress to reduce the blast radius of successful exploitation.

bash

# Verify installed Coolify version and upgrade
docker exec coolify php artisan --version

# Pull and deploy the fixed release
curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash

# Audit environment variable keys for shell metacharacters
docker exec coolify-db psql -U coolify -c \
  "SELECT id, key FROM environment_variables WHERE key !~ '^[A-Z_][A-Z0-9_]*$';"