Authenticated Remote Command Injection in Coolify Prior to 4.0.0-beta.469

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: GitHub, Inc.

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, an authenticated remote command injection vulnerability in application deployment handling allows users with application write permissions to achieve remote code execution and exfiltrate sensitive environment variables through deployment logs via fields such as dockerfile_location and deployment commands. This issue is fixed in version 4.0.0-beta.469.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-06

Last Modified

2026-07-06

Generated

2026-07-07

AI Q&A

2026-07-07

EPSS Evaluated

N/A

NVD

CVE-2026-34038

Affected Vendors & Products

Vendor	Product	Version / Range
coolify	coolify	to 4.0.0-beta.469 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Coolify, an open-source tool for managing servers, applications, and databases. Before version 4.0.0-beta.469, users with application write permissions could exploit an authenticated remote command injection flaw during application deployment. By manipulating fields such as dockerfile_location and deployment commands, these users could execute arbitrary remote code and extract sensitive environment variables through deployment logs.

Impact Analysis

The vulnerability allows an attacker with certain permissions to execute arbitrary code remotely on the affected system. This can lead to full system compromise, including the ability to exfiltrate sensitive environment variables, which may contain secrets or credentials. The impact includes complete loss of confidentiality, integrity, and availability of the system.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Coolify to version 4.0.0-beta.469 or later, where the issue is fixed.

Hi! I’m here to help you understand CVE-2026-34038. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70