Vulnerability · Published Sep 2, 2026 · Assigned by VulnCheck
CVE-2026-84694Coolify before 4.2.0 Remote Code Execution via Environment Variable Key
High 8.8
In plain English
A high-severity OS command injection in coolify from coollabsio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.8%top 41.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the server host outside containers.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| coollabsio | coolify | 0 – before 4.2.0 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/coollabsio/coolify product
- Patch Commit patch
- https://github.com/coollabsio/coolify/blob/v4.1.2/app/Support/ValidationPatterns.php technical-description
- https://github.com/coollabsio/coolify/blob/v4.1.2/app/Policies/ApplicationPolicy.php technical-description
- Coolify v4.2.0 Release Notes release-notes
- VulnCheck Advisory: Coolify before 4.2.0 Remote Code Execution via Environment Variable Key third-party-advisory