CVE-2026-42153 coollabsio CVE debrief

Who should care

Users of Coolify versions prior to 4.0.0-beta.474 should be aware of this vulnerability and take immediate action to upgrade to the patched version. This includes operators managing servers, applications, and databases with Coolify, as well as platform administrators, vulnerability management teams, and security teams who need to review and restrict database user permissions, monitor database container logs for suspicious activity, and consider implementing compensating controls for exposed systems.

Technical summary

The vulnerability is caused by the use of attacker-controlled database settings (postgres_user and postgres_db) in shell-form commands for PostgreSQL healthcheck command generation. This allows an authenticated user to inject commands executed in the database container, potentially leading to unauthorized access or data breaches. The issue has a CVSS score of 8.8 and is classified as HIGH severity. The vulnerability exists in the PostgreSQL healthcheck command generation, where attacker-controlled database settings are used in shell-form commands, allowing an authenticated user to inject commands executed in the database container.

Defensive priority

High priority should be given to upgrading to Coolify version 4.0.0-beta.474 or later. Additionally, users should review and restrict database user permissions, monitor database container logs for suspicious activity, and consider implementing compensating controls for exposed systems. It is also essential to review the official advisory and CVE record to validate affected systems and plan for updates or mitigations. Defenders should verify the integrity of the database container and consider implementing monitoring and detection measures to identify potential security incidents. Asset inventory and vulnerability management teams should be notified to ensure that affected systems are identified and prioritized for remediation. Rollback and change window planning should be considered to minimize potential downtime and ensure a smooth remediation process. Source tracking and incident response planning should also be reviewed to ensure that security teams are prepared to respond to potential security incidents. Regular revalidation and retesting of remediated assets should be performed to ensure that the vulnerability has been fully mitigated. Exceptions and retest results should be documented and tracked to ensure that all affected systems have been remediated. The Coolify GitHub repository should be reviewed for additional information and updates on the patched version. Compensating controls, such as network segmentation or access controls, may be necessary for exposed systems while remediation is scheduled and verified. Monitoring and detection measures should be implemented to identify potential security incidents related to the vulnerability. Asset inventory and vulnerability management teams should prioritize remediation of affected systems based on risk and potential impact. Remediation efforts should be tracked and documented to ensure that all affected systems have been remediated. The vulnerability management process should be reviewed and updated to ensure that similar vulnerabilities are identified and remediated in a timely manner. Security teams should review and update incident response plans to ensure that they are prepared to respond to potential 0

Recommended defensive actions

• Upgrade to Coolify version 4.0.0-beta.474 or later
• Review and restrict database user permissions
• Monitor database container logs for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The vulnerability is confirmed by the CVE record and NVD detail. The issue is fixed in version 4.0.0-beta.474, which is available on the Coolify GitHub repository. Evidence limits suggest that additional verification may be required to confirm affected scope and severity. Defenders should review the official advisory and CVE record to validate affected systems and plan for updates or mitigations. The vulnerability allows an authenticated user to inject commands executed in the database container, potentially leading to unauthorized access or data breaches. Users should review and restrict database user permissions, monitor database container logs for suspicious activity, and consider implementing compensating controls for exposed systems.

Official resources