CVE-2026-34168
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Coolify prior to version 4.0.0-beta.471 contains a shell command injection vulnerability. The LocalPersistentVolume.name field is interpolated directly into docker volume shell commands without proper shell argument escaping, allowing an authenticated user to execute arbitrary commands on managed servers when the resource is deleted.
Risk Assessment
An attacker can take over servers managed by Coolify, leading to compromise of confidentiality, integrity, and availability of data and services.
Recommendation
Immediately upgrade Coolify to version 4.0.0-beta.471 or later, which includes the fix for this vulnerability.
Original NVD description (English source)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the LocalPersistentVolume.name field is interpolated directly into docker volume shell commands without shell argument escaping, allowing an authenticated user to set a storage name containing shell metacharacters and execute commands on managed servers when the resource is deleted. This issue is fixed in version 4.0.0-beta.471.