Vulnerability Description
Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the server host outside containers.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/coollabsio/coolify
- https://github.com/coollabsio/coolify/blob/v4.1.2/app/Policies/ApplicationPolicy
- https://github.com/coollabsio/coolify/blob/v4.1.2/app/Support/ValidationPatterns
- https://github.com/coollabsio/coolify/commit/b50839d4515b115b7ded5db609471440249
- https://github.com/coollabsio/coolify/releases/tag/v4.2.0
- https://www.vulncheck.com/advisories/coolify-before-4.2.0-remote-code-execution-
FAQ
What is CVE-2026-84694?
CVE-2026-84694 is a vulnerability with a CVSS score of 8.8 (HIGH). Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into envir...
How severe is CVE-2026-84694?
CVE-2026-84694 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-84694?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.