CVE-2026-42153: Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-06 · updated 2026-10-25
Weakness: CWE-78

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL healthcheck command generation used attacker-controlled database settings (postgres_user and postgres_db) in shell-form commands, allowing an authenticated user to inject commands executed in the database container. This issue is fixed in version 4.0.0-beta.474.

Affected products

coollabsio coolify: before 4.0.0-beta.474

References

https://github.com/coollabsio/coolify/commit/b74f54302b1a857c22c55fe1210d700859b0b3df
https://github.com/coollabsio/coolify/pull/9674
https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.474
https://github.com/coollabsio/coolify/security/advisories/GHSA-gvc4-f276-r88p
https://github.com/coollabsio/coolify/security/advisories/GHSA-gvc4-f276-r88p

Get alerted when CVE-2026-42153 or the next vulnerability affects your stack