What is the CVSS score of CVE-2026-34048?

CVE-2026-34048 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Coolify are affected by CVE-2026-34048?

Coolify versions prior to 4.0.0-beta.471 contain a critical authorization flaw that allows any team member with basic application access to execute arbitrary commands on your entire server fleet,…. A patch is available.

How to fix or mitigate CVE-2026-34048?

Within 24 hours: Restrict terminal WebSocket access to administrator roles only using Coolify's role-based access controls; audit current team membership and remove unnecessary elevated access. Within 7 days: Enable audit logging for all terminal and administrative actions; review server access logs for signs of unauthorized command execution. Within 30 days: Apply vendor patch to Coolify 4.0.0-beta.471 or later immediately upon release and verify all instances are updated within 24 hours of deployment availability.

Coolify CVE-2026-34048

EUVD-2026-41995 CRITICAL

Improper Authorization (CWE-285)

2026-07-07 GitHub_M

Authentication Bypass Coolify

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable websocket route, low complexity, exploitable by an already-authenticated low-privilege team member (PR:L), no interaction; command execution on managed hosts crosses a trust boundary (S:C) with full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 07, 2026 - 05:01 EUVD

Analysis Generated

Jul 07, 2026 - 04:03 vuln.today

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal websocket bootstrap routes only check authentication and do not enforce terminal authorization, allowing a low-privileged team member to connect to terminal routes and execute commands on team servers. This issue is fixed in version 4.0.0-beta.471.

AnalysisAI

Improper authorization in Coolify's terminal websocket bootstrap routes lets any low-privileged team member execute arbitrary commands on team-managed servers, because the routes verify only that a request is authenticated but never check whether the caller is authorized to use the terminal. Affecting all Coolify versions prior to 4.0.0-beta.471, this CWE-285 flaw carries a critical 9.9 CVSS score with a scope change, effectively granting shell access to underlying infrastructure from a minimal application role. No public exploit identified at time of analysis, but the low complexity and low privilege bar make it a high-priority patch.

Technical ContextAI

Coolify is a self-hostable, open-source PaaS for deploying and managing servers, applications, and databases, offering a browser-based terminal to interact with connected hosts over websockets. The vulnerability lives in the terminal websocket 'bootstrap' routes, which gate access on authentication (is this a logged-in user?) but omit the authorization step (is this user permitted to open a terminal on this team's servers?). This is a textbook CWE-285 Improper Authorization / broken access control: a missing per-object permission check on a sensitive endpoint. Because a Coolify-managed terminal proxies commands to real backend servers, bypassing the check converts a limited application role into interactive command execution on the host OS, which is why CVSS assigns a scope change (S:C). The affected product is identified by CPE cpe:2.3:a:coollabsio:coolify:*:*:*:*:*:*:*:*, covering all builds before the fix.

RemediationAI

Vendor-released patch: 4.0.0-beta.471 - upgrade all Coolify instances to v4.0.0-beta.471 or later, which adds the missing terminal authorization enforcement (see release https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471, advisory https://github.com/coollabsio/coolify/security/advisories/GHSA-mw6q-2hmg-mhxv, and fix commit 847166a3f89b7c80972fa0d2e5c754976f95b6ad). If you cannot upgrade immediately, reduce exposure by tightly restricting team membership and removing or downgrading low-trust accounts, since exploitation requires an authenticated team member; audit team rosters for stale or shared accounts. As additional compensating controls, place the Coolify web/websocket interface behind network restrictions or a VPN so only trusted operators can reach the terminal routes, and review server access logs for unexpected terminal sessions - noting these controls limit reachability but do not close the authorization gap itself, so patching remains essential.