Remote Code Execution Vulnerability in Coolify by Coollabs

CVE-2026-42143

What is CVE-2026-42143?

Coolify, an open-source platform designed for managing servers, applications, and databases, contains a vulnerability that allows authenticated users to inject shell metacharacters. This security flaw occurs when user-controlled persistent volume names are executed in shell commands on managed servers without proper escaping or validation. When volume operations are triggered, it opens a pathway for attackers to execute commands with root privileges. The issue has been addressed in version 4.0.0-beta.471.

References