CVE-2026-42201— coolLabs Coolify 命令注入漏洞
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| ベンダー | プロダクト | Version Range | ステータス |
|---|---|---|---|
| coollabsio | coolify | < 4.0.0-beta.474 | affected |
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-42201の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands
ソース: NVD (National Vulnerability Database)
脆弱性説明
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, database credential fields (redis_password, keydb_password, dragonfly_password, clickhouse_admin_user, clickhouse_admin_password, postgres_user, mysql_user) are validated only as 'string' at the API layer, with zero shell-safety checks. These values are then interpolated directly into Docker Compose YAML command: strings without any escaping. This issue is fixed in version 4.0.0-beta.474.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
coolLabs Coolify 命令注入漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
coolLabs Coolify是coolLabs团队开源的一个开源和自托管的 Heroku/Netlify/Vercel 替代品。 coolLabs Coolify 4.0.0-beta.474之前版本存在命令注入漏洞，该漏洞源于数据库凭证字段（redis_password、keydb_password、dragonfly_password、clickhouse_admin_user、clickhouse_admin_password、postgres_user、mysql_user）在API层仅验证为
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| coollabsio | coolify | < 4.0.0-beta.474 | - |
II. CVE-2026-42201の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-42201のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-42201 补丁与修复 (2)
CVE-2026-42201 厂商安全公告 (1)
CVE-2026-42201 厂商页面 (1)
Same Patch Batch · coollabsio · 2026-07-07 · 21 CVEs total
| CVE-2026-34047 | 9.9 CRITICAL | Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution |
| CVE-2026-34037 | 9.9 CRITICAL | Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo() |
| CVE-2026-34048 | 9.9 CRITICAL | Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privilege |
| CVE-2026-42200 | 8.8 HIGH | Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE |
| CVE-2026-34158 | 8.8 HIGH | Coolify: Command injection via single-quote breakout in Docker Compose custom commands |
| CVE-2026-34034 | 8.8 HIGH | Coolify: Host RCE via Sentinel token injection |
| CVE-2026-34168 | 8.8 HIGH | Coolify: Command injection via unsanitized persistent storage name in docker volume comman |
| CVE-2026-34058 | 8.8 HIGH | Coolify: OS Command Injection via Unmanaged Container Operations - Remote Code Execution |
| CVE-2026-34152 | 8.8 HIGH | Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport) |
| CVE-2026-34035 | 8.8 HIGH | Coolify: Host RCE via Log Drain secret/env command injection |
| CVE-2026-34057 | 8.8 HIGH | Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Cont |
| CVE-2026-42143 | 8.8 HIGH | Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers |
| CVE-2026-34171 | 8.0 HIGH | Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-know |
| CVE-2026-34044 | 7.7 HIGH | Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped) |
| CVE-2026-34198 | 5.3 MEDIUM | Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing |
| CVE-2026-42147 | 4.9 MEDIUM | Coolify: SSRF via S3 Storage Endpoint in testConnection() |
| CVE-2026-34170 | 4.3 MEDIUM | Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL |
| CVE-2026-34149 | 3.3 LOW | Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs |
| CVE-2026-42145 | 3.1 LOW | Coolify: File Upload Without Type or Size Validation in Database Backup Restore |
| CVE-2026-42172 | 3.1 LOW | Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Access |
IV. 関連脆弱性
同じ製品: coolify
- CVE-2026-34158
Coolify: Command injection via single-quote breakout in Dock - CVE-2026-34170
Coolify: Server-Side Request Forgery via attacker-controlled - CVE-2026-34037
Cross-Tenant Resource Cloning via Broken Object-Level Author - CVE-2026-34048
Coolify: Missing authorization on terminal websocket bootstr - CVE-2026-34057
Coolify: Authenticated Remote Code Execution via Command Inj
同じベンダー: coollabsio
- CVE-2026-34158
Coolify: Command injection via single-quote breakout in Dock - CVE-2026-34170
Coolify: Server-Side Request Forgery via attacker-controlled - CVE-2026-34037
Cross-Tenant Resource Cloning via Broken Object-Level Author - CVE-2026-34048
Coolify: Missing authorization on terminal websocket bootstr - CVE-2026-34057
Coolify: Authenticated Remote Code Execution via Command Inj
同じ弱点: CWE-78
- CVE-2026-55849
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `- - CVE-2026-60102
Horde VFS < 3.0.1 OS Command Injection via Horde_Vfs_Smb Dri - CVE-2026-54344
ToolJet GitHub Actions comment body shell injection exposes - CVE-2026-15033
christopherthielen check-peer-dependencies peerDependencies - CVE-2026-44454
Coder vulnerable to workspace auto-creation via crafted URL
V. CVE-2026-42201へのコメント
まだコメントはありません