Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELL_SAFE_COMMAND_PATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-deployment command fields, allowing an authenticated team member to inject shell commands that execute on the host. This issue is fixed in version 4.0.0-beta.474.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-42204 Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELL_… https://www.cve.org/CVERecord?id=CVE-2026-42204
Post summary
The post cites CVE-2026-42204 for a regression affecting Coolify 4.0.0‑beta.471 to 4.0.0‑beta.473, but offers no further technical or remediation details.
🚨*CVE* CVE-2026-42204 Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELL_… https://www.cve.org/CVERecord?id=CVE-2026-42204 ----- Traducción: CVE-2026-42204 Coo… http://infoflow.cloud`
Post summary
The post mentions CVE-2026-42204 for Coolify with a brief mention of a regression, but provides no PoC, exploit, patch, active use, or detailed technical info, resulting in a general awareness statement.