PT-2026-56145

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, database credential fields redis password, keydb password, dragonfly password, clickhouse admin user, clickhouse admin password, postgres user, mysql user are validated onl...

CVE-2026-42201: Improper Neutralization of Special Elements used in an OS Command

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, database credential fields redispassword, keydbpassword, dragonflypassword, clickhouseadminuser, clickhouseadminpassword, postgresuser, mysqluser are validated only as...

CVE-2026-42204

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELLSAFECOMMANDPATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-deployment command fields, allowing an...

CVE-2026-42204

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELLSAFECOMMANDPATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-deployment command fields, allowing an...

CVE-2026-42204

Coolify CVE-2026-42204 affects the 4.0.0-beta.471 to 4.0.0-beta.473 releases, where a regression in the SHELL_SAFE_COMMAND_PATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-deployment command fields. This enabled an authenticated team member to inject shell commands t...

CVE-2026-42204 Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELLSAFECOMMANDPATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-deployment command fields, allowing an...

CVE-2026-42204 Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELLSAFECOMMANDPATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-deployment command fields, allowing an...

CVE-2026-42204: Improper Neutralization of Special Elements used in an OS Command

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELLSAFECOMMANDPATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-deployment command fields, allowing an...

Fedora 45 : docker-compose (2026-caecf8f2d7)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-caecf8f2d7 advisory. Automatic update for docker-compose-5.3.0-1.fc45. Changelog Thu Jul 2 2026 Bradley G Smith - 5.3.0-1 - Update to release v5.3.0 - Resolves:...

CVE-2026-27955 Coolify: Command Injection via Single-Quote Breakout in `executeInDocker()`

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the executeInDocker helper wraps commands in bash -c '$command' without escaping single quotes. User-controlled dockercomposecustombuildcommand and...

EUVD-2026-40332

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the executeInDocker helper wraps commands in bash -c '$command' without escaping single quotes. User-controlled dockercomposecustombuildcommand and...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: external-secrets-fips, crossplane-provider-aws-ecs-fips, syft-fips, databricks-cli-fips, gatus, crossplane-provider-aws-secretsmanager, etcd, crossplane-provider-aws-ecr-fips, kubernetes-fips, trivy-fips, witness, crossplane-provider-aws-cloudsearch-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: external-secrets-fips, crossplane-provider-aws-ecs-fips, syft-fips, databricks-cli-fips, gatus, crossplane-provider-aws-secretsmanager, etcd, crossplane-provider-aws-ecr-fips, kubernetes-fips, trivy-fips, witness, crossplane-provider-aws-cloudsearch-fips,...

GO-2026-5308 Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend

Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend...

CVE-2026-53492 vulnerabilities

Vulnerabilities for packages: k8ssandra-client, grype-fips, tekton-pipelines, teleport, buildkitd-fips, cluster-api-helm-controller-fips, syft-fips, linkerd2, helm-operator-fips, trivy, newrelic-infrastructure-agent-fips, gatekeeper, rancher-helm, k9s-fips, beats, grype, kubescape-server-fips,...

GHSA-33VJ-92QQ-66HC vulnerabilities

Vulnerabilities for packages: k8ssandra-client, grype-fips, tekton-pipelines, teleport, buildkitd-fips, cluster-api-helm-controller-fips, syft-fips, linkerd2, helm-operator-fips, trivy, newrelic-infrastructure-agent-fips, gatekeeper, rancher-helm, k9s-fips, beats, grype, kubescape-server-fips,...

GHSA-CVXM-645Q-P574 vulnerabilities

Vulnerabilities for packages: k8ssandra-client, grype-fips, tekton-pipelines, teleport, buildkitd-fips, cluster-api-helm-controller-fips, syft-fips, linkerd2, helm-operator-fips, trivy, newrelic-infrastructure-agent-fips, gatekeeper, rancher-helm, k9s-fips, beats, grype, kubescape-server-fips,...

CVE-2026-53489 vulnerabilities

Vulnerabilities for packages: k8ssandra-client, grype-fips, tekton-pipelines, teleport, buildkitd-fips, cluster-api-helm-controller-fips, syft-fips, linkerd2, helm-operator-fips, trivy, newrelic-infrastructure-agent-fips, gatekeeper, rancher-helm, k9s-fips, beats, grype, kubescape-server-fips,...

CVE-2026-50195 vulnerabilities

Vulnerabilities for packages: k8ssandra-client, grype-fips, tekton-pipelines, teleport, buildkitd-fips, cluster-api-helm-controller-fips, syft-fips, linkerd2, helm-operator-fips, trivy, newrelic-infrastructure-agent-fips, gatekeeper, rancher-helm, k9s-fips, beats, grype, kubescape-server-fips,...

GHSA-JPCC-P29G-P8MQ vulnerabilities

Vulnerabilities for packages: k8ssandra-client, grype-fips, teleport, buildkitd-fips, cluster-api-helm-controller-fips, syft-fips, linkerd2, helm-operator-fips, trivy, newrelic-infrastructure-agent-fips, gatekeeper, rancher-helm, k9s-fips, grype, kubescape-server-fips, trivy-fips, helm-fips,...