Authenticated Command Injection Vulnerability in Coolify Management Tool

CVE-2026-27957

What is CVE-2026-27957?

Coolify, a self-hostable management tool for servers and applications, contains an authenticated command injection vulnerability in its CA Certificate management feature. This flaw permits authenticated users to execute arbitrary commands as the configured SSH user, potentially leading to a complete compromise of the managed server and any associated Docker containers. The issue is addressed in version 4.0.0-beta.464, and it is critical for users to update to this version to mitigate risks.

References