Coolify CVE-2026-34035

Requires an authenticated Coolify account (PR:L) with the ability to set a log drain secret or an environment variable value - those specific fields are interpolated into host shell commands without sufficient encoding, so supplying shell metacharacters in either is the trigger. Limiting factors: the attacker must already possess valid credentials on the Coolify instance and be able to reach the dashboard over the network; there is no unauthenticated path and no user interaction is required. Exposure is greatest on internet-facing, multi-user instances prior to 4.0.0-beta.466; single-trusted-operator or network-isolated deployments materially limit realistic exploitation.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 High) indicates network-reachable, low-complexity exploitation requiring only low privileges (an authenticated Coolify user) and no user interaction, with high impact to confidentiality, integrity and availability - consistent with host command execution. No EPSS score, KEV listing, SSVC decision, or POC was provided, so the exploitation-probability and automatable signals are unknown; absence of these signals is not evidence of low risk. The practical priority is high for any internet-exposed Coolify instance with multiple or untrusted users, since the only barrier is a valid low-privilege account and the payoff is host compromise; for single-operator, network-isolated deployments the practical exposure is lower because the attacker must already hold an account.

An attacker who holds (or registers/phishes) a low-privilege Coolify account configures a log drain or an application environment variable whose value contains shell metacharacters such as a command-substitution payload. When Coolify builds and runs the corresponding shell command on the host, the injected payload executes with the platform's host privileges, giving the attacker code execution and a pivot into managed servers and containers. No public POC is referenced, but the low attack complexity makes weaponization straightforward.