CVE-2026-84694

HighCVSS 8.8/10Last modified Sep 10, 2026

Description

Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the server host outside containers.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Sep 2, 2026
Last modified: Sep 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-846958.7BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 CVE-2026-846968.2Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent CVE-2026-846975.3Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IP CVE-2026-846986.5PX4 Autopilot contains a heap buffer overflow vulnerability in the sd_bench command that writes a four-byte block number into a user-supplie CVE-2026-846999.1Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticat CVE-2026-84709.1IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic r CVE-2026-847008.6PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 (e.g. 11221 when the CVE-2026-847015.4NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with CVE-2026-847027.5facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directo CVE-2026-847067.6A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates CVE-2026-847125.3A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ CVE-2026-847136.5A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_