Coolify: low-privileged member injects Docker Compose directives and gets root on the host

Impact

Any member with permission to create or update a project can inject arbitrary Docker Compose directives - for example a service that bind-mounts the host filesystem - and execute commands as root on the host OS, bypassing container isolation entirely. On a machine that also runs workloads, that means the lowest deployment role on the Coolify instance becomes root over everything scheduled on that host, including other tenants' containers and any credentials or model artifacts mounted into them. The deployment control plane itself is the escalation path, so restricting container capabilities downstream does not help.

Who can reach it

A remote, authenticated user holding only low-privileged member rights on the Coolify instance. No host access and no admin role needed.

What to do

Upgrade Coolify to 4.0.0-beta.420.7 or later and restart the Coolify services; the fix is in that release per the GitHub advisory. Until the upgrade, treat every member who can edit a project as equivalent to host root and cut the member list down accordingly. Rollout is a control-plane restart, not a node reboot, but any host already managed by a vulnerable instance with untrusted members should be considered compromised and rebuilt.

References

Related entries

• Kyverno: percent-encoded traversal in Policy apiCall urlPath escapes the namespace clamp to cluster adminCVE-2026-100706 · Kyverno admission controller (Policy apiCall urlPath namespace clamp)Critical
• Docker Hub: converting an account reassigned a PAT to another user without rotating the secretCVE-2026-105445 · Docker Hub (account-to-organization conversion, personal access tokens)Critical
• Kyverno: namespaced mutating policy can fabricate cross-namespace targets and overwrite cluster-wide resourcesCVE-2026-122303 · Kyverno (NamespacedMutatingPolicy mutate-existing targetMatchConstraints)Critical
• Kyverno: namespaced CleanupPolicy context entries run with the cleanup controller's ServiceAccountCVE-2026-122304 · Kyverno cleanup controller (CleanupPolicy context loader)Critical
• Kyverno: apiCall urlPath is validated after cleaning but executed raw, reaching cluster-scoped endpointsCVE-2026-122310 · Kyverno admission controller (Policy context.apiCall urlPath)Critical
• Kyverno: unvalidated path segments in CEL resource.get/post let namespaced policies escape their namespaceCVE-2026-122311 · Kyverno CEL policies (resource.get / resource.post path segments)Critical