Remote Code Execution in Coolify Prior to 4.0.0-beta.471

Executive Summary

CVE-2026-34152 is a command injection vulnerability in Coolify versions prior to 4.0.0-beta.471. The issue occurs because pre-deployment and post-deployment commands, although single-quote escaped, are sent through SSH heredoc transport that preserves newline characters. This allows an authenticated user with application configuration permissions to inject additional shell commands by including newline characters in these commands. The remote server interprets these newlines as separate commands, enabling arbitrary command execution during deployment.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary command execution on the remote server during deployment. An attacker with the ability to configure the application can inject malicious shell commands, potentially leading to full host takeover if the container is privileged. The impact includes high confidentiality, integrity, and availability risks, as attackers can execute commands that compromise the system, steal data, or disrupt services.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves injection of additional shell commands via newlines in pre-deployment and post-deployment commands sent over SSH heredoc transport. Detection can focus on identifying unusual or suspicious multi-line commands or payloads containing newline characters in deployment configurations.

You can audit the deployment command configurations for the presence of newline characters or shell metacharacters that could be used for injection.

• Check deployment command fields for newline characters using commands like: grep -P '\n' or grep -P '\r' in configuration files or database entries.
• Monitor SSH sessions or logs for unexpected command sequences or multiple commands executed during deployment.
• Use network monitoring tools to detect unusual SSH heredoc payloads containing newline characters that could indicate injection attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Coolify to version 4.0.0-beta.471 or later, where the vulnerability is fixed by normalizing whitespace and removing newline characters from pre-deployment and post-deployment commands before execution.

If immediate upgrade is not possible, restrict permissions to prevent unauthorized users from modifying deployment commands, as exploitation requires authenticated users with configuration access.

Additionally, implement input validation to disallow newline characters and shell metacharacters in deployment command inputs.

Consider hardening the SSH transport layer and monitoring deployment logs for suspicious command injection attempts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated user with application configuration permissions to inject arbitrary commands on the remote server during deployment, potentially leading to host takeover if the container is privileged.

Such unauthorized command execution can compromise the confidentiality, integrity, and availability of data and systems managed by Coolify.

Because of the high impact on confidentiality and integrity, this vulnerability could lead to non-compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and secure system operations.

Useful 0 Not Useful 0