CVE-2026-84694

EUVD-2026-69785
Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the server host outside containers.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 37.76%
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/coollabsio/coolify
https://github.com/coollabsio/coolify/blob/v4.1.2/app/Policies/ApplicationPolicy.php
https://github.com/coollabsio/coolify/blob/v4.1.2/app/Support/ValidationPatterns.php
https://github.com/coollabsio/coolify/commit/b50839d4515b115b7ded5db609471440249995da
https://github.com/coollabsio/coolify/releases/tag/v4.2.0
https://www.vulncheck.com/advisories/coolify-before-4.2.0-remote-code-execution-via-environment-variable-key