Authenticated Remote Command Injection in Coolify Prior to 4.0.0-beta.469

Executive Summary

This vulnerability exists in Coolify, an open-source tool for managing servers, applications, and databases. Before version 4.0.0-beta.469, users with application write permissions could exploit an authenticated remote command injection flaw during application deployment. By manipulating fields such as dockerfile_location and deployment commands, these users could execute arbitrary remote code and extract sensitive environment variables through deployment logs.

Useful 0 Not Useful 0

Detection Guidance

CVE-2026-34038 is an authenticated remote command injection vulnerability in Coolify that allows users with application write permissions to execute arbitrary commands during deployment by injecting malicious payloads into fields such as dockerfile_location and deployment commands.

To detect this vulnerability on your system, you should first verify the version of Coolify you are running. Versions prior to 4.0.0-beta.469 are vulnerable.

Detection can involve checking deployment logs for suspicious command injection patterns or unexpected environment variable dumps, especially in fields like dockerfile_location, pre_deployment_command, or deployment commands.

• Check the Coolify version by running a command or inspecting the deployment environment to ensure it is 4.0.0-beta.469 or later.
• Review deployment logs for unusual shell metacharacters such as `;`, `&&`, or backticks that may indicate command injection attempts.
• Use grep or similar tools to search logs or configuration files for suspicious patterns, for example:
• grep -E '(;|&&|`)' /path/to/coolify/deployment/logs/*
• Audit application deployment configurations for unexpected or malformed inputs in dockerfile_location, pre_deployment_command, and related fields.

Because the vulnerability requires authenticated access with deployment permissions, monitoring user activities and deployment triggers for anomalous behavior can also help detect exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker with certain permissions to execute arbitrary code remotely on the affected system. This can lead to full system compromise, including the ability to exfiltrate sensitive environment variables, which may contain secrets or credentials. The impact includes complete loss of confidentiality, integrity, and availability of the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows authenticated users with application write permissions to execute remote code and exfiltrate sensitive environment variables through deployment logs. Such unauthorized access and data exfiltration can lead to breaches of confidentiality and integrity of sensitive data.

As a result, organizations using affected versions of Coolify may face compliance risks with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and prevention of unauthorized access.

Failure to address this vulnerability could lead to violations of these regulations, potentially resulting in legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Coolify to version 4.0.0-beta.469 or later, where the issue is fixed.

Useful 0 Not Useful 0