CVE-2026-34594

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, an authenticated command injection vulnerability in the Destination Network Management functionality allows users with destination management permissions to execute arbitrary commands as root on managed servers. The "network" parameter is passed directly to shell commands without proper sanitization, enabling full remote code execution on the host system. This vulnerability is fixed in 4.0.0-beta.471.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/coollabsio/coolify/security/advisories/GHSA-mf8p-rj62-9f9m
https://github.com/coollabsio/coolify/security/advisories/GHSA-mf8p-rj62-9f9m

Configurations

No configuration.

History

25 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Coolify es una herramienta de código abierto y autoalojable para gestionar servidores, aplicaciones y bases de datos. Antes de la versión 4.0.0-beta.471, una vulnerabilidad de inyección de comandos autenticada en la funcionalidad de Gestión de Red de Destino permite a los usuarios con permisos de gestión de destino ejecutar comandos arbitrarios como root en los servidores gestionados. El parámetro ’network’ se pasa directamente a los comandos de shell sin una sanitización adecuada, lo que permite la ejecución remota de código completa en el sistema anfitrión. Esta vulnerabilidad se corrigió en la versión 4.0.0-beta.471.

Information

Published : 2026-06-29 21:16

Updated : 2026-10-25 21:10

NVD link : CVE-2026-34594

Mitre link : CVE-2026-34594

CVE.ORG link : CVE-2026-34594

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-34594", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34594", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-01T14:22:37.720820Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "coollabsio", "product": "coolify", "versions": [{"status": "affected", "version": "< 4.0.0-beta.471"}]}]}], "published": "2026-06-29T21:16:43.840", "references": [{"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-mf8p-rj62-9f9m", "source": "security-advisories@github.com"}, {"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-mf8p-rj62-9f9m", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, an authenticated command injection vulnerability in the Destination Network Management functionality allows users with destination management permissions to execute arbitrary commands as root on managed servers. The \"network\" parameter is passed directly to shell commands without proper sanitization, enabling full remote code execution on the host system. This vulnerability is fixed in 4.0.0-beta.471."}, {"lang": "es", "value": "Coolify es una herramienta de c\u00f3digo abierto y autoalojable para gestionar servidores, aplicaciones y bases de datos. Antes de la versi\u00f3n 4.0.0-beta.471, una vulnerabilidad de inyecci\u00f3n de comandos autenticada en la funcionalidad de Gesti\u00f3n de Red de Destino permite a los usuarios con permisos de gesti\u00f3n de destino ejecutar comandos arbitrarios como root en los servidores gestionados. El par\u00e1metro \u2019network\u2019 se pasa directamente a los comandos de shell sin una sanitizaci\u00f3n adecuada, lo que permite la ejecuci\u00f3n remota de c\u00f3digo completa en el sistema anfitri\u00f3n. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 4.0.0-beta.471."}], "lastModified": "2026-10-25T21:10:00.770", "sourceIdentifier": "security-advisories@github.com"}