What is the CVSS score of CVE-2026-34152?

CVE-2026-34152 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Coolify are affected by CVE-2026-34152?

A command injection vulnerability in Coolify before 4.0.0-beta.471 allows authenticated users to execute arbitrary code on all servers managed through the platform during deployments.. A patch is available.

How to fix or mitigate CVE-2026-34152?

Within 24 hours: restrict Coolify administrative access to essential personnel only; revoke unnecessary accounts and perform full audit of active user access. Within 7 days: enforce multi-factor authentication for all Coolify access and implement comprehensive audit logging of all deployment commands. Within 30 days: monitor Coolify security advisories for availability of patched version; establish testing and deployment plan for patched release once available.

Coolify CVE-2026-34152

EUVD-2026-41990 HIGH

OS Command Injection (CWE-78)

2026-07-07 GitHub_M

Command Injection Coolify

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Authenticated low-privilege user (PR:L) injects commands over the network with low complexity and no interaction, yielding full RCE on the managed host (C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 07, 2026 - 05:01 EUVD

Analysis Generated

Jul 07, 2026 - 03:58 vuln.today

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, pre-deployment and post-deployment commands are single-quote escaped but then sent through SSH heredoc transport that preserves newlines, allowing an authenticated user to inject additional shell statements that execute on the remote server during deployment. This issue is fixed in version 4.0.0-beta.471.

AnalysisAI

Command injection in Coolify before 4.0.0-beta.471 lets an authenticated user break out of the pre-deployment and post-deployment command fields and run arbitrary shell statements on the target deployment server. The supplied commands are single-quote escaped but then piped through an SSH heredoc transport that preserves newlines, so newline-delimited injected statements survive escaping and execute during deployment. No public exploit is identified at time of analysis, though the fixing pull request and commit are public and make the root cause easy to reconstruct; CVSS is 8.8 (High).

Technical ContextAI

Coolify is an open-source, self-hostable platform-as-a-service (CPE cpe:2.3:a:coollabsio:coolify) that manages servers, applications, and databases and drives deployments over SSH. The flaw is CWE-78 (OS Command Injection): user-supplied pre/post-deployment commands are wrapped in single quotes to neutralize shell metacharacters, but the payload is then sent into a remote shell via an SSH heredoc (<<EOF ... EOF) that faithfully preserves embedded newlines. Single-quote escaping does nothing to stop a newline from terminating one command and beginning the next inside the heredoc body, so an attacker can smuggle additional statements that the remote shell executes with the privileges of the Coolify deployment process on the managed host.

RemediationAI

Vendor-released patch: upgrade Coolify to 4.0.0-beta.471 or later, which corrects how pre/post-deployment commands are handled before SSH heredoc transport (fix in PR #9173, commit ad95d65). If you cannot upgrade immediately, restrict who can configure deployment commands by limiting Coolify accounts to trusted operators and removing edit access to the pre/post-deployment command fields for lower-trust users, and audit existing resources for unexpected newline-containing command values - the trade-off is reduced self-service for team members. On multi-tenant instances, isolating each project's deployment onto a dedicated, non-privileged remote server account limits blast radius but adds operational overhead. Reference advisory GHSA-5qp8-9gg7-4c86 (https://github.com/coollabsio/coolify/security/advisories/GHSA-5qp8-9gg7-4c86) and the release notes at https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471.