CVE-2026-27955

MEDIUM

Coolify: Command Injection via Single-Quote Breakout in `executeInDocker()`

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-27955. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-27955, a command injection vulnerability in Coolify's executeInDocker() helper. The code includes placeholder logic for target probing but lacks actual exploit implementation or technical details about the vulnerability mechanics.

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the executeInDocker() helper wraps commands in bash -c '{$command}' without escaping single quotes. User-controlled docker_compose_custom_build_command and docker_compose_custom_start_command fields are interpolated directly, allowing a single quote to break out of the bash -c argument and execute commands on the managed server host (outside the intended Docker container context). This vulnerability is fixed in 4.0.0-beta.464.

Exploits (1)

github STUB 1 stars
by HermesNA-1 · pythonpoc
https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-27955_coolify_open-source.py

This repository contains an auto-generated stub module for CVE-2026-27955, a command injection vulnerability in Coolify's executeInDocker() helper. The code includes placeholder logic for target probing but lacks actual exploit implementation or technical details about the vulnerability mechanics.

Classification
Stub 99%
Attack Type
Rce
Complexity
Moderate
Reliability
Theoretical
Target: Coolify prior to 4.0.0-beta.464
No auth needed
Prerequisites: Network access to Coolify's exposed service port · Target running vulnerable version (<4.0.0-beta.464)
mistral-large-3 · analyzed Jul 09, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 6.6
EPSS 0.0022
EPSS Percentile 12.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-78
Status published
Products (1)
coollabsio/coolify < 4.0.0-beta.464
Published Jun 30, 2026
Tracked Since Jun 30, 2026