CVE-2026-34058
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In Coolify prior to version 4.0.0-beta.471, the Livewire component Server\Resources exposes public methods (startUnmanaged, stopUnmanaged, restartUnmanaged) that accept a container ID parameter directly from the browser without sanitization. This parameter is interpolated into shell commands executed via SSH on managed servers, allowing any authenticated team member to execute arbitrary OS commands on remote servers.
Risk Assessment
An attacker can take control of remote servers managed by Coolify, leading to compromise of confidentiality, integrity, and availability of data and infrastructure.
Recommendation
Immediately update Coolify to version 4.0.0-beta.471 or later, which includes a fix that eliminates the command injection vulnerability.
Original NVD description (English source)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the Livewire component Server\Resources exposes public methods (startUnmanaged, stopUnmanaged, restartUnmanaged) that accept a container ID parameter directly from the browser without any sanitization or escaping. This parameter is interpolated directly into shell commands executed via SSH on managed servers, enabling any authenticated team member to execute arbitrary OS commands on remote servers. This issue is fixed in version 4.0.0-beta.471.