Command Injection in Coolify Prior to 4.0.0-beta.464

Executive Summary

CVE-2026-27955 is a command injection vulnerability in the Coolify application, specifically in the executeInDocker() helper function.

The vulnerability occurs because the function wraps commands in bash -c '{$command}' without properly escaping single quotes in user-controlled fields such as docker_compose_custom_build_command and docker_compose_custom_start_command.

This improper escaping allows an attacker to break out of the intended Docker container context and execute arbitrary commands on the managed server host.

Exploitation requires high privileges, including API write access and application update authorization.

The vulnerability bypasses container isolation, enabling commands to run directly on the host system.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with sufficient privileges to execute arbitrary commands on the managed server host outside of the Docker container.

Such command execution on the host can lead to unauthorized access, data compromise, service disruption, or further system compromise.

Because the vulnerability bypasses container isolation, it increases the risk of severe impact despite existing access controls.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Coolify to version 4.0.0-beta.464 or later, where the executeInDocker() helper function properly escapes single quotes in user-controlled fields.

If upgrading immediately is not possible, ensure that user-controlled fields such as docker_compose_custom_build_command and docker_compose_custom_start_command are not set with untrusted input, as these fields are directly interpolated and can lead to command injection.

The root cause is improper escaping of single quotes in commands wrapped by bash -c, so applying proper escaping at the source code level or at all call sites is recommended to prevent exploitation.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves command injection through user-controlled fields in the Coolify application, specifically in the executeInDocker() helper function. Detection would focus on identifying unusual or unauthorized commands executed on the managed server host outside the Docker container context.

Since the vulnerability requires high privileges and API write access to inject malicious commands, monitoring API usage and changes to the docker_compose_custom_build_command and docker_compose_custom_start_command fields can help detect exploitation attempts.

Suggested commands to detect potential exploitation include:

• Review recent changes or suspicious entries in the Coolify configuration related to docker_compose_custom_build_command and docker_compose_custom_start_command.
• Check process execution logs on the host for commands executed via bash -c that include unescaped single quotes or unexpected command sequences.
• Use commands like `ps aux | grep bash` or `ps aux | grep docker` to identify suspicious bash processes spawned by Coolify.
• Audit API logs for unauthorized or unusual write requests to the Coolify API that modify build or start commands.
• If possible, enable command auditing on the host system (e.g., using auditd) to log execution of commands that could indicate exploitation.

Useful 0 Not Useful 0