Coolify: unescaped single quotes in custom compose commands escape the container and run on the host

Impact

executeInDocker() wraps user-controlled commands in single quotes without escaping embedded quotes, so a user who can edit application settings can close the quote in docker_compose_custom_build_command or docker_compose_custom_start_command and have arbitrary commands run on the managed server host during the next deployment, outside the Docker confinement that was supposed to hold them. The deploying identity is root or docker-group on the host, so the result is host compromise reached from an application-settings form. This is a separate flaw from the CA certificate injection (CVE-2026-27957) and has its own fixed version.

Who can reach it

Network, authenticated: an account with permission to edit an application's settings in Coolify. Execution happens on the next deployment of that application, so it is not instantaneous.

What to do

Upgrade Coolify to 4.0.0-beta.469 or later and restart the Coolify services. No change is needed on the managed hosts, but any host that ran a deployment with attacker-edited custom compose commands should be treated as compromised and rebuilt. Interim mitigation is to restrict who can edit application settings.

References

Related entries

• ingress-nginx: Comment-based nginx configuration injectionCVE-2026-4342 · ingress-nginxHigh
• BentoML (Dockerfile template, docker.base_image interpolation): A multi-line docker.base_image value in bento.yamlCVE-2026-44345 · BentoML (Dockerfile template, docker.base_image interpolation)High
• mcp-server-kubernetes: read-only and allowed-tool restrictions are not enforced at tool executionCVE-2026-46519 · mcp-server-kubernetes (ALLOW_ONLY_READONLY_TOOLS / ALLOWED_TOOLS enforcement)High
• Argo CD repo-server: shell metacharacters in a repository proxy URL run commands and leak Git/Helm/OCI credentialsCVE-2026-55797 · Argo CD repo-server (SSH repository proxy ProxyCommand)High
• Rancher: plaintext non-expiring registration tokens let an attacker join a rogue node to a clusterCVE-2026-55997 · Rancher (downstream cluster registration tokens)High
• Tetragon: unauthenticated gRPC API on localhost lets a same-node pod rewrite tracing policyCVE-2026-65960 · Cilium Tetragon (Helm default gRPC TCP listener on localhost:54321)High