CVE-2026-84694

Coolify before 4.2.0 fails to properly escape environment variable key names before interpolating them into Docker commands executed over SSH on managed servers, an OS command injection flaw (CWE-78). An authenticated user who can create or edit environment variables can embed shell metacharacters in a variable key name, causing attacker-controlled commands to run in a shell on the target server. Because execution occurs on the server host rather than inside a container, the attacker escapes container isolation and gains arbitrary command execution with high confidentiality, integrity, and availability impact on that host. Any deployment running a Coolify version prior to 4.2.0 is affected, particularly installations managing remote servers over SSH. No exploitation has been observed: there is no known public PoC, the flaw is not in CISA KEV, and EPSS estimates a 0.5% probability of exploitation within 30 days.

What to do: Upgrade Coolify to version 4.2.0 or later, which properly escapes environment variable key names. As interim mitigation, restrict creation and editing of environment variables to trusted users and audit existing variable key names on managed servers for shell metacharacters such as ;, &&, |, $, backticks, or spaces.