Coolify CVE-2026-34038

Exploitation requires an authenticated Coolify account holding application write permissions on at least one application (PR:L) and the ability to modify deployment-related fields - specifically dockerfile_location or deployment commands - then trigger a deployment. There is no user-interaction requirement (UI:N) and the Coolify management interface must be network-reachable to the attacker (AV:N). Limiting factors that reduce real-world risk: the attacker cannot be fully anonymous - they must already possess deploy/write access, so single-operator instances or instances where write access is tightly held are far less exposed than multi-tenant or team deployments with lower-trust members. All Coolify versions before 4.0.0-beta.469 in default configuration are affected once that permission level is obtained.

This is a genuine high-priority issue rather than an inflated high-CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) indicates network-reachable, low-complexity exploitation requiring only low privileges (an authenticated user with application write permissions) and no user interaction, with full confidentiality/integrity/availability impact amplified by a scope change. The principal limiting factor is authentication: the attacker must already hold application write permissions, so this is more of a privilege-escalation/tenant-breakout risk than an anonymous internet-wide RCE - relevant for multi-user Coolify instances, teams with limited-trust members, or any environment where a lower-privileged deploy account could be phished or compromised. No EPSS score, KEV listing, or POC was provided in the input, so real-world exploitation frequency cannot be quantified from available data; the CWE-78 class and the trivial exploitation mechanics nonetheless make weaponization straightforward once details are public.

A team member (or a compromised/low-trust account) that has been granted application write permissions on a shared Coolify instance edits an application's deployment settings, placing shell metacharacters and an injected command in the dockerfile_location or deployment command field. When the deployment runs, Coolify's build pipeline executes the injected command on the host, allowing the attacker to run arbitrary code and read environment variables of other applications, which are then visible in the deployment logs. No public POC was identified at time of analysis, and the low attack complexity (AC:L) means the technique is straightforward once the injectable field is known.