What is the CVSS score of CVE-2026-34058?

CVE-2026-34058 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Coolify are affected by CVE-2026-34058?

Coolify, a self-hosted server-management platform, contains an OS command injection vulnerability allowing any authenticated team member to execute arbitrary shell commands on all managed remote…. A patch is available.

How to fix or mitigate CVE-2026-34058?

Within 24 hours: Audit all Coolify team accounts and revoke access for non-essential personnel; document business justification for each remaining team member. Within 7 days: Implement network segmentation isolating Coolify management access and restrict SSH egress to approved target servers only; enable enhanced command logging and alerting for all executed commands. Within 30 days: Monitor vendor advisories for Coolify 4.0.0-beta.471 or later release; plan and execute controlled upgrade once patched version is available and tested in staging, or migrate to alternative server-management platforms if patch timeline is unacceptable.

Coolify CVE-2026-34058

EUVD-2026-41983 HIGH

OS Command Injection (CWE-78)

2026-07-07 GitHub_M

Command Injection Coolify Coollabsio

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable Livewire endpoint (AV:N/AC:L), requires an authenticated team account (PR:L), no user interaction, and unsanitized shell injection yields full OS command execution (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 07, 2026 - 05:01 EUVD

Analysis Generated

Jul 07, 2026 - 04:00 vuln.today

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the Livewire component Server\Resources exposes public methods (startUnmanaged, stopUnmanaged, restartUnmanaged) that accept a container ID parameter directly from the browser without any sanitization or escaping. This parameter is interpolated directly into shell commands executed via SSH on managed servers, enabling any authenticated team member to execute arbitrary OS commands on remote servers. This issue is fixed in version 4.0.0-beta.471.

AnalysisAI

OS command injection in Coolify's self-hosted server-management platform (all versions prior to 4.0.0-beta.471) lets any authenticated team member execute arbitrary shell commands on any managed remote server. The flaw lives in the Livewire Server\Resources component, whose public startUnmanaged/stopUnmanaged/restartUnmanaged methods take a browser-supplied container ID and interpolate it unescaped into SSH-executed shell commands. No public exploit identified at time of analysis and it is not in CISA KEV, but the trivially low complexity (CVSS 8.8) makes exploitation straightforward for anyone with a team account.

Technical ContextAI

Coolify is an open-source, self-hostable PaaS (a Heroku/Netlify/Vercel alternative) that provisions and controls applications, databases, and Docker containers across fleets of remote servers over SSH. It is built on the Laravel Livewire framework, where server-side component methods can be invoked directly from the browser. The affected Server\Resources component declares startUnmanaged, stopUnmanaged, and restartUnmanaged as public (browser-callable) methods that receive a container ID argument. Because Livewire exposes public methods as remote endpoints, an attacker can call them with an arbitrary value. That value is concatenated directly into a shell command string (e.g. a docker start/stop/restart invocation) that Coolify then runs on the target managed host through its SSH connection. This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command) issue: the absence of shell-escaping or input validation allows shell metacharacters (;, |, $(), backticks) to break out of the intended command. The affected package is coollabsio/coolify (CPE cpe:2.3:a:coollabsio:coolify).

RemediationAI

Vendor-released patch: upgrade Coolify to 4.0.0-beta.471 or later, which adds sanitization/escaping of the container ID parameter in the Server\Resources Livewire component (see PR 9172 and commit 944a038 referenced in advisory GHSA-rh5x-qx77-fq9v). This is the primary and only complete fix. If you cannot upgrade immediately, reduce exposure by tightly restricting team membership - remove or downgrade any non-essential team members and treat every team account as capable of full server RCE, since the vulnerability escalates any team member to arbitrary command execution. Additionally, place the Coolify web UI behind a VPN, IP allowlist, or reverse-proxy authentication so the Livewire endpoints are not broadly reachable, and monitor SSH command activity on managed servers for anomalous docker/container invocations; note the trade-off that network restrictions do not stop a legitimate-but-malicious team member, so upgrading remains essential. Advisory and patch: https://github.com/coollabsio/coolify/security/advisories/GHSA-rh5x-qx77-fq9v and https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471.