What’s Vulnerable › Vulnerabilities

CVE-2026-84694: Coolify before 4.2.0 Remote Code Execution via Environment Variable Key

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-02 · updated 2026-09-10
• Weakness: CWE-78

Description

Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the server host outside containers.

Affected products

• coollabsio coolify: before 4.2.0 — fixed in 4.2.0

How to fix

Upgrade to a fixed version: coollabsio coolify 4.2.0. Check the vendor advisory for mitigations.

References

• https://github.com/coollabsio/coolify
• https://github.com/coollabsio/coolify/blob/v4.1.2/app/Policies/ApplicationPolicy.php
• https://github.com/coollabsio/coolify/blob/v4.1.2/app/Support/ValidationPatterns.php
• https://github.com/coollabsio/coolify/commit/b50839d4515b115b7ded5db609471440249995da
• https://github.com/coollabsio/coolify/releases/tag/v4.2.0
• https://www.vulncheck.com/advisories/coolify-before-4.2.0-remote-code-execution-via-environment-variable-key

Get alerted when CVE-2026-84694 or the next vulnerability affects your stack