CVE-2026-34599
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk69th percentile - higher than 69% of all known CVEs
Summary
In Coolify prior to version 4.0.0-beta.471, an authenticated command injection vulnerability exists in the GetLogs Livewire component. Users with team membership (lowest privilege member role) can execute arbitrary commands as root on managed servers.
Risk Assessment
An attacker can gain full control over servers managed by Coolify, compromising the confidentiality, integrity, and availability of data and services.
Recommendation
Immediately update Coolify to version 4.0.0-beta.471 or later, which contains the fix for this vulnerability.
Original NVD description (English source)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, there is an authenticated command injection vulnerability in the GetLogs Livewire component which allows users with team membership (lowest privilege member role) to execute arbitrary commands as root on managed servers. The $container Livewire public property is interpolated directly into shell commands (docker logs, docker service logs) without sanitization, and can be modified by any client via the Livewire wire protocol because it lacks the #[Locked] attribute. This issue is fixed in version 4.0.0-beta.471.