VulnSocial

CVE-2026-42201Disclosure

LOWCVSS 3.3 · LOW

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, database credential fields (redis_password, keydb_password, dragonfly_password, clickhouse_admin_user, clickhouse_admin_password, postgres_user, mysql_user) are validated only as 'string' at the API layer, with zero shell-safety checks. These values are then interpolated directly into Docker Compose YAML command: strings without any escaping. This issue is fixed in version 4.0.0-beta.474.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-07-07: 2Technical Details · 2026-07-07: 107-07
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-42201 Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, database credential fields (redis_passwor… https://www.cve.org/CVERecord?id=CVE-2026-42201 ----- Traducción: CVE-2026-42201 Coo… http://infoflow.cloud`

    Post summary

    The post announces CVE‑2026‑42201 as affecting Coolify’s database credential fields prior to version 4.0.0‑beta.474, linking to the official CVE record, but it provides no PoC, exploit code, or evidence of active exploitation.

    0000036
    91 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-42201 Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, database credential fields (redis_passwor… https://www.cve.org/CVERecord?id=CVE-2026-42201

    Post summary

    The statement merely cites the CVE identifier and a version in which the issue exists, with no deeper technical or operational details.

    00000639
    57.8K followersView on X

Explore more

Back to dashboard