CVE-2026-34594

HIGH

Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management

Title source: cna
STIX 2.1

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, an authenticated command injection vulnerability in the Destination Network Management functionality allows users with destination management permissions to execute arbitrary commands as root on managed servers. The "network" parameter is passed directly to shell commands without proper sanitization, enabling full remote code execution on the host system. This vulnerability is fixed in 4.0.0-beta.471.

References (1)

Core 1
Core References

Scores

CVSS v3 8.8
EPSS 0.0109
EPSS Percentile 61.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (1)
coollabsio/coolify < 4.0.0-beta.471
Published Jun 29, 2026
Tracked Since Jun 30, 2026