CVE-2026-84694

Published: Sep 2, 2026Modified: Sep 10, 2026Deferred

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the server host outside containers.

Related CWEs

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (6)

https://github.com/coollabsio/coolify

Source: disclosure@vulncheck.com

https://github.com/coollabsio/coolify/blob/v4.1.2/app/Policies/ApplicationPolicy.php

Source: disclosure@vulncheck.com

https://github.com/coollabsio/coolify/blob/v4.1.2/app/Support/ValidationPatterns.php

Source: disclosure@vulncheck.com

https://github.com/coollabsio/coolify/commit/b50839d4515b115b7ded5db609471440249995da

Source: disclosure@vulncheck.com

https://github.com/coollabsio/coolify/releases/tag/v4.2.0

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/coolify-before-4.2.0-remote-code-execution-via-environment-variable-key

Source: disclosure@vulncheck.com

Timeline

No history available yet.