CVE-2026-42201 coollabsio CVE debrief

Who should care

Users of Coolify versions prior to 4.0.0-beta.474 should apply the update to mitigate potential risks associated with this vulnerability. This includes administrators and security teams responsible for managing servers, applications, and databases. They should review and update affected deployments, and monitor for suspicious activity related to database credential fields.

Technical summary

Coolify, prior to version 4.0.0-beta.474, validates database credential fields (such as redis_password, keydb_password, dragonfly_password, clickhouse_admin_user, clickhouse_admin_password, postgres_user, mysql_user) only as 'string' at the API layer without shell-safety checks. These values are then directly interpolated into Docker Compose YAML command strings without escaping, potentially allowing command injection. The issue is fixed in version 4.0.0-beta.474, which includes proper validation and escaping of these fields.

Defensive priority

Apply the patch from version 4.0.0-beta.474. Review and update affected deployments. Monitor for suspicious activity related to database credential fields. Ensure that deployments are updated to the latest version and that security teams are aware of the potential risks associated with this vulnerability.

Recommended defensive actions

• Apply the update to Coolify version 4.0.0-beta.474 or later.
• Review and update affected deployments.
• Monitor for suspicious activity related to database credential fields.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-07-07T05:16:51.237Z and has not been modified since then. The NVD entry is currently in the 'Received' status. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The issue involves inadequate validation of database credential fields in Coolify, potentially allowing command injection.

Official resources