The vulnerability arises from PostgreSQL healthcheck command generation that incorporates attacker‑controlled database settings (postgres_user and postgres_db) into shell‑form commands. This allows an authenticated user to inject arbitrary shell commands that execute inside the database container with root privileges. The attack directly results in the ability to run any command as root within the container, potentially compromising database data and the underlying host if container isolation is broken. The flaw is a classic command injection (CWE‑78) and is classified as high severity.

Coollabsio’s Coolify application, prior to version 4.0.0‑beta.474, is impacted. Users running self‑hosted Coolify instances with PostgreSQL healthchecks enabled and with authenticated database settings are within the scope of this vulnerability.

The CVSS score of 8.8 indicates high impact. The EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. Exploitation database credentials used in the healthcheck. Once the injection succeeds, the attacker obtains root-level execution inside the database container, which can be leveraged to alter data or pivot to other services if container isolation is inadequate. While the exploitation likelihood remains low due to the limited attack surface, the impact of a successful exploit is severe.