CVE-2026-42143 coollabsio CVE debrief

Who should care

Administrators and users of Coolify versions prior to 4.0.0-beta.471 should be aware of this high-severity vulnerability and take immediate action to update their installations. Affected operators, platforms, and security teams should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. Vulnerability management and security teams should prioritize updating Coolify installations to version 4.0.0-beta.471 or later.

Technical summary

Coolify, an open-source tool for managing servers, applications, and databases, was vulnerable to a high-severity issue (CVSS Score: 8.8) allowing authenticated members to inject shell metacharacters and execute commands as root. This was due to user-controlled persistent volume names being interpolated into shell commands without proper escaping or validation. The issue was addressed in version 4.0.0-beta.471. Affected product context indicates that Coolify installations prior to 4.0.0-beta.471 are vulnerable. Defensive impact suggests that updating to version 4.0.0-beta.471 or later will prevent potential exploitation.

Defensive priority

High priority should be given to updating Coolify installations to version 4.0.0-beta.471 or later to prevent potential exploitation. Defenders should review the official advisory and track exceptions for retesting remediated assets.

Recommended defensive actions

• Update Coolify to version 4.0.0-beta.471 or later
• Review and restrict access to volume operations
• Monitor for suspicious activity related to volume management
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its fix. Additional information can be found in the referenced GitHub commit, release, and advisory. Evidence limits suggest that further verification is needed to confirm affected scope and severity. Defenders should review the official advisory and track exceptions for retesting remediated assets.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.