What is the CVSS score of CVE-2026-34038?

CVE-2026-34038 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 2.5%.

Which versions of Coolify are affected by CVE-2026-34038?

Coolify, a self-hosted deployment platform, contains a critical vulnerability that allows users with deployment permissions to gain control of production servers and access shared credentials and…. A patch is available.

How to fix or mitigate CVE-2026-34038?

Within 24 hours: Audit who has application write permissions in Coolify and implement principle of least privilege for access control. Within 7 days: Test and deploy Coolify v4.0.0-beta.469 in staging environment to validate compatibility, then upgrade production instances. Within 30 days: Monitor for Coolify v4.0.0 (stable release) and plan migration from beta to stable version.

Coolify CVE-2026-34038

EUVD-2026-41943 CRITICAL

OS Command Injection (CWE-78)

2026-07-06 GitHub_M

Command Injection RCE Coolify

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable dashboard (AV:N), trivial injection (AC:L), needs authenticated app-write user (PR:L), no interaction (UI:N); injection escapes app to host affecting other tenants (S:C) with full C/I/A loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 06, 2026 - 22:02 EUVD

Analysis Generated

Jul 06, 2026 - 21:42 vuln.today

CVE Published

Jul 06, 2026 - 20:48 cve.org

CRITICAL 9.9

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, an authenticated remote command injection vulnerability in application deployment handling allows users with application write permissions to achieve remote code execution and exfiltrate sensitive environment variables through deployment logs via fields such as dockerfile_location and deployment commands. This issue is fixed in version 4.0.0-beta.469.

AnalysisAI

Remote command injection in Coolify (self-hosted PaaS) before 4.0.0-beta.469 lets an authenticated user with application write permissions inject OS commands through deployment-handling fields such as dockerfile_location, achieving arbitrary code execution on the deployment host and exfiltrating secrets via deployment logs. The flaw scores CVSS 9.9 because command injection breaks out of the application context to compromise the underlying server (scope change), exposing environment variables and other applications' secrets. No public exploit has been identified at time of analysis, but the fix is available in tagged release v4.0.0-beta.469.

Technical ContextAI

Coolify is an open-source, self-hostable alternative to Heroku/Netlify/Vercel that orchestrates Docker-based deployments of applications and databases across managed servers. The root cause is CWE-78 (OS Command Injection): user-controllable deployment parameters - notably dockerfile_location and deployment commands - are passed into shell command construction during the build/deploy pipeline without adequate sanitization, so shell metacharacters break out of the intended command. Because deployments run with the privileges of Coolify's deployment engine on the target host (typically with Docker/root-level access), injected commands execute in that trusted context. The affected package is coollabsio/coolify (cpe:2.3:a:coollabsio:coolify), and the CVSS scope-change flag (S:C) reflects that the injection escapes the per-application boundary to affect the host and other tenants' resources.

RemediationAI

Vendor-released patch: upgrade to Coolify 4.0.0-beta.469 or later (tagged release https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.469; advisory https://github.com/coollabsio/coolify/security/advisories/GHSA-qqrq-r9h4-x6wp). This is the primary and recommended fix. If you cannot upgrade immediately, reduce exposure by tightening who holds application write permissions - remove or downgrade untrusted team members and service accounts, since exploitation requires that privilege - and audit deployment configurations for suspicious values in dockerfile_location and custom deployment command fields. Restrict network access to the Coolify dashboard/API to trusted operators (e.g., behind a VPN or IP allowlist) to shrink the attacker population, accepting the trade-off of less convenient remote administration. Review recent deployment logs for signs of injected commands or leaked environment variables, and rotate any secrets that may have been exposed through those logs.