CVE-2026-34599

Received Received - Intake

Authenticated Command Injection in Coolify via Livewire Component

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: GitHub, Inc.

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, there is an authenticated command injection vulnerability in the GetLogs Livewire component which allows users with team membership (lowest privilege member role) to execute arbitrary commands as root on managed servers. The $container Livewire public property is interpolated directly into shell commands (docker logs, docker service logs) without sanitization, and can be modified by any client via the Livewire wire protocol because it lacks the #[Locked] attribute. This issue is fixed in version 4.0.0-beta.471.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-06

Last Modified

2026-07-06

Generated

2026-07-07

AI Q&A

2026-07-07

EPSS Evaluated

N/A

NVD

CVE-2026-34599

Affected Vendors & Products

Vendor	Product	Version / Range
coolify	coolify	to 4.0.0-beta.471 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Coolify, an open-source tool for managing servers, applications, and databases. Before version 4.0.0-beta.471, there was an authenticated command injection vulnerability in the GetLogs Livewire component. Users with the lowest privilege team member role could exploit this flaw to execute arbitrary commands as root on managed servers.

The issue arises because the $container Livewire public property is directly interpolated into shell commands (such as docker logs and docker service logs) without any sanitization. Since this property can be modified by any client via the Livewire wire protocol and lacks the #[Locked] attribute, it allows attackers to inject malicious commands.

This vulnerability was fixed in version 4.0.0-beta.471.

Impact Analysis

This vulnerability can have severe impacts because it allows users with minimal privileges to execute arbitrary commands as the root user on managed servers.

Full system compromise due to root-level command execution.
Potential unauthorized access to sensitive data and system resources.
Disruption of services or applications running on the affected servers.
Possibility of installing malware or creating persistent backdoors.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Coolify to version 4.0.0-beta.471 or later, where the issue is fixed.

This vulnerability allows authenticated users with team membership to execute arbitrary commands as root due to unsanitized input in the GetLogs Livewire component. Upgrading ensures the $container property is properly secured.

Hi! I’m here to help you understand CVE-2026-34599. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70