CVE-2026-34035

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, log drain secret and environment values were interpolated into shell commands without sufficient encoding, allowing an authenticated user to inject commands executed on the host. This issue is fixed in version 4.0.0-beta.466.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/coollabsio/coolify/commit/fcd574e1eb1c2f504c48e5be4a5cb6d69f8f1f55
https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.466
https://github.com/coollabsio/coolify/security/advisories/GHSA-3xm2-hqg8-4m2p
https://github.com/coollabsio/coolify/security/advisories/GHSA-3xm2-hqg8-4m2p

Configurations

No configuration.

History

25 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Coolify es una herramienta de código abierto y autoalojable para gestionar servidores, aplicaciones y bases de datos. Antes de la versión 4.0.0-beta.466, los valores secretos y de entorno del drenaje de logs se interpolaban en comandos de shell sin codificación suficiente, permitiendo a un usuario autenticado inyectar comandos ejecutados en el host. Este problema se ha corregido en la versión 4.0.0-beta.466.

Information

Published : 2026-07-07 04:17

Updated : 2026-10-25 20:10

NVD link : CVE-2026-34035

Mitre link : CVE-2026-34035

CVE.ORG link : CVE-2026-34035

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-34035", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34035", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-07T13:41:13.576185Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "coollabsio", "product": "coolify", "versions": [{"status": "affected", "version": "< 4.0.0-beta.466"}]}]}], "published": "2026-07-07T04:17:47.873", "references": [{"url": "https://github.com/coollabsio/coolify/commit/fcd574e1eb1c2f504c48e5be4a5cb6d69f8f1f55", "source": "security-advisories@github.com"}, {"url": "https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.466", "source": "security-advisories@github.com"}, {"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-3xm2-hqg8-4m2p", "source": "security-advisories@github.com"}, {"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-3xm2-hqg8-4m2p", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, log drain secret and environment values were interpolated into shell commands without sufficient encoding, allowing an authenticated user to inject commands executed on the host. This issue is fixed in version 4.0.0-beta.466."}, {"lang": "es", "value": "Coolify es una herramienta de c\u00f3digo abierto y autoalojable para gestionar servidores, aplicaciones y bases de datos. Antes de la versi\u00f3n 4.0.0-beta.466, los valores secretos y de entorno del drenaje de logs se interpolaban en comandos de shell sin codificaci\u00f3n suficiente, permitiendo a un usuario autenticado inyectar comandos ejecutados en el host. Este problema se ha corregido en la versi\u00f3n 4.0.0-beta.466."}], "lastModified": "2026-10-25T20:10:00.147", "sourceIdentifier": "security-advisories@github.com"}