CVE-2026-84694: Coollabsio Coolify

High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days.

Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the server host outside containers.

Affected products

• Coollabsio Coolify: before 4.2.0 (fixed in 4.2.0)

Published 2026-09-02. Last modified 2026-09-10.