What is the CVSS score of CVE-2026-34047?

CVE-2026-34047 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Coolify are affected by CVE-2026-34047?

Coolify versions prior to 4.0.0-beta.471 contain a critical privilege escalation vulnerability allowing any authenticated user to execute arbitrary commands on servers outside their authorized scope.. A patch is available.

How to fix or mitigate CVE-2026-34047?

Within 24 hours: Inventory all Coolify deployments and identify current versions. Within 7 days: Upgrade all affected instances to v4.0.0-beta.471 or later. Within 30 days: Review access logs for suspicious terminal WebSocket activity and audit user permission assignments.

Coolify CVE-2026-34047

EUVD-2026-41981 CRITICAL

Incorrect Authorization (CWE-863)

2026-07-07 GitHub_M

Authentication Bypass Coolify

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Authenticated user needed so PR:L; network-reachable low-complexity WebSocket route with no interaction; terminal command execution on out-of-scope hosts crosses the authorization boundary giving S:C and full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 07, 2026 - 05:01 EUVD

Analysis Generated

Jul 07, 2026 - 04:04 vuln.today

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the expected authorization middleware, allowing an authenticated user to access terminal functionality for resources outside the authorized scope and potentially execute commands. This issue is fixed in version 4.0.0-beta.471.

AnalysisAI

Privilege escalation via broken authorization in Coolify's self-hosted server/application management platform lets any authenticated low-privilege user reach terminal WebSocket functionality for resources outside their authorized scope, prior to version 4.0.0-beta.471. Because the terminal bootstrap routes skipped the expected authorization middleware, an attacker with a valid account can potentially execute commands on servers and containers they should not control. No public exploit identified at time of analysis, and there is no CISA KEV listing, but the fix is confirmed in release v4.0.0-beta.471.

Technical ContextAI

Coolify (vendor coollabsio) is an open-source, self-hostable PaaS-style tool for managing servers, applications, and databases, offering an in-browser terminal that connects to managed hosts and containers over WebSocket. The flaw is a CWE-863 Incorrect Authorization: the WebSocket bootstrap routes that initialize a terminal session did not enforce the middleware that verifies the requesting user is authorized for the target resource (team/project/server scoping). As a result, the object-level access check that should tie a terminal session to the caller's permitted resources was absent on those routes, so scope boundaries between tenants/teams were not honored. The affected CPE is cpe:2.3:a:coollabsio:coolify:*:*:*:*:*:*:*:*, covering all versions prior to the patched 4.0.0-beta.471 beta release line.

RemediationAI

Upgrade to Coolify 4.0.0-beta.471 or later, which restores the missing authorization middleware on the terminal WebSocket bootstrap routes (Vendor-released patch: 4.0.0-beta.471); see the advisory at https://github.com/coollabsio/coolify/security/advisories/GHSA-652w-qv22-2r7c and release https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471. If immediate patching is not possible, reduce exposure by tightening who holds accounts on the instance - remove or suspend untrusted and lower-trust users, since exploitation requires an authenticated session - and restrict network reachability of the Coolify web/WebSocket interface to trusted administrators via a VPN, firewall allowlist, or reverse-proxy access controls; the trade-off is reduced convenience for legitimate remote users. On multi-tenant instances, consider isolating separate teams onto separate Coolify installations until patched, at the cost of operational overhead. These are compensating controls only; applying the fixed release is the definitive remediation.