CVE-2026-34035
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Coolify prior to version 4.0.0-beta.466 has a vulnerability where log drain secrets and environment values are interpolated into shell commands without proper encoding. This allows an authenticated user to inject commands executed on the host.
Risk Assessment
An attacker can execute arbitrary commands on the server, leading to full system compromise, data theft, or service disruption.
Recommendation
Immediately update Coolify to version 4.0.0-beta.466 or later, which includes the necessary security fixes.
Original NVD description (English source)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, log drain secret and environment values were interpolated into shell commands without sufficient encoding, allowing an authenticated user to inject commands executed on the host. This issue is fixed in version 4.0.0-beta.466.