Command Injection in Coolify Prior to 4.0.0-beta.466

Executive Summary

CVE-2026-34035 is a critical Remote Code Execution (RCE) vulnerability in Coolify, an open-source self-hosted platform for managing servers and applications. The issue exists in versions prior to 4.0.0-beta.466 and arises because log drain secret and environment values are interpolated directly into shell commands without proper encoding or escaping.

This improper handling allows an authenticated user to inject malicious shell commands through fields like the Axiom API Key. When these commands are executed on the host, it can lead to arbitrary command execution. For example, an attacker could inject a payload that runs system commands such as `id` and writes output to files on the server.

The root cause is the lack of neutralization of special shell characters in environment variables used in shell commands, leading to command injection (CWE-78). The vulnerability is fixed in version 4.0.0-beta.466 by encoding environment variables safely and validating input.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows an attacker with low privileges and authentication to execute arbitrary commands on the host system running Coolify.

• Full host compromise due to arbitrary command execution.
• Loss of confidentiality, as attackers can access sensitive data on the server.
• Loss of integrity, since attackers can modify files or configurations.
• Loss of availability, as attackers could disrupt services or delete critical data.

Because the attack vector is network-based, requires low complexity, and no user interaction, it poses a high risk to affected systems.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your Coolify installation is running a version prior to 4.0.0-beta.466, as those versions are vulnerable to command injection via the Log Drain feature.

To detect exploitation attempts or presence of injected commands, you can look for suspicious files or outputs created by injected commands, such as the example payload that writes the output of the `id` command to `/tmp/coolify_poc_logdrain`.

Suggested commands to detect potential exploitation include:

• Check for the presence of suspicious files created by command injection payloads, e.g., `ls -l /tmp/coolify_poc_logdrain`
• View contents of suspicious files to confirm command execution, e.g., `cat /tmp/coolify_poc_logdrain`
• Search logs for suspicious command injection patterns or shell metacharacters in Log Drain configuration fields.
• Audit the version of Coolify installed by running `coolify --version` or checking the deployment metadata to confirm if it is older than 4.0.0-beta.466.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate and most effective mitigation step is to upgrade Coolify to version 4.0.0-beta.466 or later, where this vulnerability is fixed.

If upgrading immediately is not possible, avoid using the Log Drain feature or restrict access to it to trusted users only, as the vulnerability requires authenticated user access.

Additional mitigation includes:

• Avoid shell-based environment variable writing in your configuration.
• Implement strict validation and escaping of secret fields before they are used in any shell command context.
• Use safe file APIs or base64-encoded static payloads for environment variables instead of direct shell interpolation.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Coolify allows authenticated users to execute arbitrary commands on the host system due to improper handling of environment variables in shell commands. This can lead to full host compromise, impacting confidentiality, integrity, and availability of data.

Such a compromise could potentially lead to unauthorized access or disclosure of sensitive data, which may violate compliance requirements under standards like GDPR or HIPAA that mandate protection of personal and health information.

However, the provided information does not explicitly discuss the direct impact on compliance with these standards or any regulatory frameworks.

Useful 0 Not Useful 0