CVE-2026-34152
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
In Coolify prior to version 4.0.0-beta.471, pre-deployment and post-deployment commands are single-quote escaped but then sent through SSH heredoc transport that preserves newlines, allowing an authenticated user to inject additional shell statements that execute on the remote server during deployment.
Risk Assessment
An attacker with authenticated access can execute arbitrary commands on the target server, leading to full server compromise, data theft, or further attacks on the infrastructure.
Recommendation
Immediately update Coolify to version 4.0.0-beta.471 or later, which includes a fix that prevents command injection.
Original NVD description (English source)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, pre-deployment and post-deployment commands are single-quote escaped but then sent through SSH heredoc transport that preserves newlines, allowing an authenticated user to inject additional shell statements that execute on the remote server during deployment. This issue is fixed in version 4.0.0-beta.471.