Coolify CVE-2026-34152

Requires an authenticated Coolify account (PR:L) with permission to set a resource's pre-deployment or post-deployment command field, and requires that a deployment of that resource actually run so the injected heredoc payload is transported over SSH and executed on the managed remote server. The specific enabling feature is the pre/post-deployment command configuration combined with SSH heredoc transport that preserves newlines. Limiting factors: exploitation is gated behind authentication and the ability to edit deployment commands, so a single-operator instance with no untrusted users has a much smaller attack surface; there is no unauthenticated path and no reported active exploitation.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) indicates a low-privilege authenticated user can achieve full CIA impact over the network with low complexity and no user interaction - a genuinely high-priority issue on any multi-user Coolify instance. The primary mitigating factor is PR:L: the attacker must already hold an authenticated Coolify account able to configure a resource's deployment commands, making this a tenant-isolation/privilege-escalation break rather than an unauthenticated internet-facing RCE. No EPSS score, KEV listing, or SSVC data was supplied, so exploitation probability cannot be quantified from the input and there is no evidence of active exploitation. The public fix commit and PR raise practical exploitability over time even though no packaged exploit is confirmed. Net: real and worth prompt patching on shared/multi-tenant deployments, lower urgency on single-operator instances where the only authenticated user is already fully trusted.

An attacker holding a low-privileged but authenticated Coolify account creates or edits an application and sets a pre-deployment command containing a newline followed by an extra shell statement such as a reverse shell or credential-harvesting command. When the deployment runs, the single-quote escaping fails to neutralize the newline inside the SSH heredoc, so the injected statement executes on the remote managed server with the deployment process's privileges. No public exploit is identified, but the fix commit publicly reveals the vulnerable heredoc handling.