Remote Code Execution in Coolify via Sentinel Token Injection

Executive Summary

CVE-2026-34034 is a critical Remote Code Execution (RCE) vulnerability in Coolify, an open-source self-hosted platform for managing servers and applications. The issue arises because the sentinel_token setting is used in shell commands without proper validation, allowing an authenticated user with access to Sentinel settings to inject malicious shell syntax. This injection leads to arbitrary command execution on the host system when the Sentinel service restarts.

The vulnerability exists in versions prior to 4.0.0-beta.466 and is caused by improper handling of user-controlled input in shell command contexts, specifically in files like StartSentinel.php, HasMetrics.php, Sentinel.php, and ServerSetting.php.

Useful 0 Not Useful 0

Compliance Impact

CVE-2026-34034 is a critical remote code execution vulnerability that allows an authenticated user to execute arbitrary commands on the host system. This can lead to unauthorized access, data breaches, and system compromise.

Such a vulnerability can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data, maintaining confidentiality, integrity, and availability of systems.

Exploitation of this vulnerability could result in unauthorized data access or modification, potentially leading to violations of data protection requirements and regulatory obligations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with low privileges and authenticated access to execute arbitrary commands on the host system remotely without user interaction. This can lead to full compromise of the server running Coolify.

• Execution of malicious commands on the host system.
• Potential unauthorized access to sensitive data (confidentiality impact).
• Modification or destruction of data and system resources (integrity and availability impact).
• Complete takeover of the affected server, leading to further attacks or disruption.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the Sentinel token setting contains suspicious shell metacharacters or payloads that could lead to command injection.

One way to detect exploitation attempts is to look for unusual commands executed on the host, such as creation of unexpected files like /tmp/coolify_poc_sentinel.

You can inspect the current Sentinel token value for unsafe characters or patterns by querying the server settings or configuration files where the token is stored.

• Use grep or similar tools to search for suspicious tokens containing shell metacharacters (e.g., quotes, semicolons, backticks) in configuration files or logs.
• Monitor system logs for commands executed by the Sentinel service, especially around service restarts.
• Example command to check for suspicious token patterns in configuration files: grep -E '[";`$]' /path/to/coolify/config
• Check for unexpected files created by exploitation attempts, e.g., ls -l /tmp/coolify_poc_sentinel

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Coolify to version 4.0.0-beta.466 or later, where the vulnerability is fixed.

The fix includes strict validation of the Sentinel token to allow only safe characters and improved shell argument escaping to prevent command injection.

Until the upgrade can be performed, restrict access to the Sentinel token settings to trusted users only, as exploitation requires authenticated access.

Avoid restarting the Sentinel service if the token value is untrusted or unknown.

Review and audit current Sentinel token values and reset them to safe values containing only alphanumeric characters and allowed symbols (dots, hyphens, underscores, plus, forward slash, equals).

Useful 0 Not Useful 0