Mitigation Strategies

Immediate mitigation steps include avoiding the use of vulnerable Coolify versions (4.x) and upgrading to a version that includes improved input validation, such as 4.1.2 or later.

Specifically, ensure that Docker image references are validated against OCI grammar and reject any shell metacharacters or control characters in image names.

Avoid constructing shell commands from user input; instead, use argument-array process execution methods to prevent shell injection.

If upgrading is not immediately possible, restrict deployment permissions and isolate the Coolify deployment environment to limit potential impact.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows remote OS command injection, potentially leading to unauthorized access and control over hosts, secrets, registries, and infrastructure. Such unauthorized access and potential data compromise could negatively impact compliance with standards like GDPR and HIPAA, which require protection of sensitive data and secure system operations.

However, the provided information does not explicitly mention compliance impacts or specific regulatory considerations.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-12815 is a critical OS command injection vulnerability found in Coolify's Docker image reference fields during deployment. The vulnerability occurs because Coolify constructs shell commands directly from user-provided Docker image references. This allows attackers to insert shell metacharacters that break out of the intended command context and execute arbitrary code on the system.

The issue affects Coolify version 4.x and involves improper input validation of image names, which leads to the possibility of remote code execution with the privileges of Coolify's deployment worker or server.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts as it allows attackers to execute arbitrary OS commands remotely on the affected system. Exploiting this flaw can lead to full compromise of the host running Coolify, including access to secrets, container registries, and the underlying infrastructure.

Attackers can leverage this to gain unauthorized control, disrupt services, steal sensitive information, or use the compromised system as a pivot point for further attacks.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves OS command injection through Docker image reference fields during deployment in Coolify. Detection can focus on monitoring deployment commands or logs for suspicious shell metacharacters or unusual command executions originating from image references.

You can inspect running Coolify deployment processes or logs for injected shell metacharacters such as ;, &, |, $, `, or other control characters in Docker image references.

Suggested commands include:

• Use process monitoring tools like `ps aux | grep coolify` to check for suspicious command lines.
• Check deployment logs for unusual image reference strings containing shell metacharacters: `grep -E '[;&|$`]' /path/to/coolify/logs/deployment.log`
• Use network monitoring tools to detect unusual outbound connections or commands triggered by deployments.

Useful 0 Not Useful 0