What is the CVSS score of CVE-2026-34047?

CVE-2026-34047 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Coolify are affected by CVE-2026-34047?

Coolify versions prior to 4.0.0-beta.471 contain a critical privilege escalation vulnerability allowing any authenticated user to execute arbitrary commands on servers outside their authorized scope.. A patch is available.

How to fix or mitigate CVE-2026-34047?

Within 24 hours: Inventory all Coolify deployments and identify current versions. Within 7 days: Upgrade all affected instances to v4.0.0-beta.471 or later. Within 30 days: Review access logs for suspicious terminal WebSocket activity and audit user permission assignments.

Coolify CVE-2026-34047

EUVD-2026-41981 CRITICAL

Incorrect Authorization (CWE-863)

2026-07-07 GitHub_M

Authentication Bypass Coolify

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Authenticated user needed so PR:L; network-reachable low-complexity WebSocket route with no interaction; terminal command execution on out-of-scope hosts crosses the authorization boundary giving S:C and full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 07, 2026 - 05:01 EUVD

Analysis Generated

Jul 07, 2026 - 04:04 vuln.today

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the expected authorization middleware, allowing an authenticated user to access terminal functionality for resources outside the authorized scope and potentially execute commands. This issue is fixed in version 4.0.0-beta.471.

AnalysisAI

Privilege escalation via broken authorization in Coolify's self-hosted server/application management platform lets any authenticated low-privilege user reach terminal WebSocket functionality for resources outside their authorized scope, prior to version 4.0.0-beta.471. Because the terminal bootstrap routes skipped the expected authorization middleware, an attacker with a valid account can potentially execute commands on servers and containers they should not control. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate to Coolify instance

Delivery

Target terminal WebSocket bootstrap route

Exploit

Bypass missing authorization check

Execution

Open terminal on out-of-scope resource

Impact

Execute arbitrary commands on host

Access

Authenticate to Coolify instance

Delivery

Target terminal WebSocket bootstrap route

Exploit

Bypass missing authorization check

Execution

Open terminal on out-of-scope resource

Impact

Execute arbitrary commands on host

Vulnerability AssessmentAI

Exploitation	The attacker must hold a valid authenticated Coolify account (CVSS PR:L) and be able to reach the terminal WebSocket bootstrap routes over the network. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are largely aligned toward high priority but with important nuance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A low-privileged but authenticated user on a shared Coolify instance - for example a developer scoped to a single project - sends a crafted terminal WebSocket bootstrap request naming a server or container belonging to another team. Because the authorization middleware is not enforced on that route, the session is established against the out-of-scope resource, and the attacker gains an interactive terminal to execute commands on hosts they were never granted access to. …
Remediation	Upgrade to Coolify 4.0.0-beta.471 or later, which restores the missing authorization middleware on the terminal WebSocket bootstrap routes (Vendor-released patch: 4.0.0-beta.471); see the advisory at https://github.com/coollabsio/coolify/security/advisories/GHSA-652w-qv22-2r7c and release https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471. … Detailed patch versions, workarounds, and compensating controls in full report.