Database/Container, Kubernetes & orchestration

Coolify: authenticated user injects commands into CA certificate management and owns the managed host

CVSS 8.8CVE-2026-27957Container, Kubernetes & orchestrationcurated

Impact

Any authenticated Coolify user can inject arbitrary commands into the CA Certificate management feature, which executes them over SSH on a managed server as the configured SSH user. Coolify requires that user to be root or in the docker group to function, so this is full compromise of the managed host and every container on it - on a GPU node that means the GPU devices, any model or dataset mounted into other tenants' containers, and the node's credentials. A low-trust account on the deployment panel becomes host root on whatever machines that panel manages, which is usually a whole fleet rather than one box.

Who can reach it

Network, authenticated: any account on the Coolify web UI or API, no administrative role required. Reachable wherever the Coolify panel is exposed.

What to do

Upgrade Coolify to 4.0.0-beta.464 or later and restart the Coolify services; the managed hosts and their workloads are not themselves modified and do not need draining. Until the panel is upgraded, treat every Coolify account as equivalent to root on every managed server and cut back who holds one.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-27957 https://github.com/coollabsio/coolify/security/advisories/GHSA-7g97-c4xv-3cjx

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.