What is the CVSS score of CVE-2026-34035?

CVE-2026-34035 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Coolify are affected by CVE-2026-34035?

Coolify before version 4.0.0-beta.466 contains an authenticated command injection vulnerability (CVSS 8.8) in log drain and environment variable handling that permits arbitrary code execution with…. A patch is available.

How to fix or mitigate CVE-2026-34035?

24 hours: Inventory all Coolify deployments and identify instances running versions prior to 4.0.0-beta.466; restrict administrative and configuration access to named accounts only; enforce MFA on all Coolify access. 7 days: Isolate Coolify management network to bastion/VPN-only access; disable log drain functionality and environment variable interpolation where operationally feasible; deploy command execution monitoring on all hosts running Coolify. 30 days: Apply patch to version 4.0.0-beta.466 or later immediately upon vendor release; conduct post-patch testing and validation; audit and harden all remaining Coolify administrative accounts.

Coolify CVE-2026-34035

EUVD-2026-41982 HIGH

OS Command Injection (CWE-78)

2026-07-07 GitHub_M

Command Injection Coolify Coollabsio

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable dashboard, low complexity, needs a low-privilege authenticated account (PR:L), no user interaction; host command execution yields full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 07, 2026 - 05:01 EUVD

Analysis Generated

Jul 07, 2026 - 04:08 vuln.today

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, log drain secret and environment values were interpolated into shell commands without sufficient encoding, allowing an authenticated user to inject commands executed on the host. This issue is fixed in version 4.0.0-beta.466.

AnalysisAI

OS command injection in Coolify (self-hosted server/application/database management platform) before 4.0.0-beta.466 lets an authenticated user execute arbitrary commands on the host by supplying log drain secret or environment values that are interpolated into shell commands without proper encoding. Because Coolify orchestrates the underlying host, the injected commands run with the platform's host-level context, effectively yielding host takeover. No public exploit identified at time of analysis; this is not in CISA KEV and no POC is referenced, so risk is driven by the ease of authenticated exploitation rather than confirmed in-the-wild activity.

Technical ContextAI

Coolify is an open-source, self-hostable PaaS (an alternative to Heroku/Netlify) that manages servers, applications and databases, frequently running with broad privileges over Docker and the host OS. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): user-controlled log drain secrets and environment variable values are concatenated into shell command strings without sufficient encoding or quoting, so shell metacharacters (for example ; | $() or backticks) break out of the intended argument and are executed by the host shell. The affected product per CPE is cpe:2.3:a:coollabsio:coolify covering all versions prior to the fixed 4.0.0-beta.466.

RemediationAI

Vendor-released patch: upgrade to Coolify v4.0.0-beta.466 or later, which corrects the encoding of log drain secret and environment values before they are used in shell commands (see advisory GHSA-3xm2-hqg8-4m2p and release https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.466). If you cannot upgrade immediately, restrict who holds Coolify accounts and avoid configuring log drains, and audit or limit the ability of untrusted users to set environment variables or log drain secrets, since those are the injection sinks; also place the Coolify dashboard behind a VPN or IP allowlist rather than exposing it to the internet to shrink the authenticated attack surface. These controls reduce exposure but do not fully close the flaw and may disrupt legitimate log-drain and multi-user workflows, so upgrading remains the only complete fix.