The vulnerability in Coolify allows any authenticated team member to execute arbitrary OS commands on remote servers. Public methods in the Livewire Server\\Resources component (startUnmanaged, stopUnmanaged, restartUnmanaged) accept a container ID directly from the browser without sanitization. That value is inserted straight into shell commands run via SSH, enabling a malicious user to inject commands and gain full command‑line control over the host (CWE-78).

All versions of Coolify distributed by coollabsio before 4.0.0-beta.471 are affected, regardless of the underlying operating system or deployment topology. The flaw was removed in the 4.0.0-beta.471 release.

The CVSS base score of 8.8 classifies this as a high‑severity vulnerability. The EPSS score of <1% indicates a very low current exploitation probability and it is not listed in the CISA KEV catalog, implying no known active exploits. Nonetheless, the attack vector requires authenticated access to the web application, meaning any team member with a valid account can abuse the unmanaged container operations to perform remote code execution on the managed servers.