What is the CVSS score of CVE-2026-34158?

CVE-2026-34158 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Coolify are affected by CVE-2026-34158?

Coolify versions prior to 4.0.0-beta.469 expose an OS command injection vulnerability allowing authenticated users with application settings edit permissions to execute arbitrary commands on the…. A patch is available.

How to fix or mitigate CVE-2026-34158?

24 hours: Audit all Coolify deployments to identify instances running versions prior to 4.0.0-beta.469; document versions and managed workloads. 7 days: Restrict application settings editor access to administrator-only accounts; implement network segmentation between Coolify and production environments; enable audit logging on all settings modifications. 30 days: Monitor vendor advisories for patch availability and upgrade timeline; develop migration plan for critical workloads if remediation exceeds organizational risk tolerance; evaluate interim relocation to alternative PaaS platforms.

Coolify CVE-2026-34158

EUVD-2026-41998 HIGH

OS Command Injection (CWE-78)

2026-07-07 GitHub_M

Command Injection Docker Coolify

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable web UI (AV:N/AC:L), requires an app-edit account (PR:L), no interaction (UI:N); command escapes container to the host so scope changes (S:C) with full host C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 07, 2026 - 06:16 EUVD

Analysis Generated

Jul 07, 2026 - 05:15 vuln.today

CVE Published

Jul 07, 2026 - 03:28 cve.org

HIGH 8.8

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, the executeInDocker() helper wraps user-controlled commands in single quotes without escaping embedded single quotes. Attackers who can edit application settings can inject a single quote into docker_compose_custom_build_command or docker_compose_custom_start_command to break out of the quoted context and execute arbitrary commands on the managed server host during deployments, escaping the intended Docker container confinement. This issue is fixed in version 4.0.0-beta.469.

AnalysisAI

OS command injection in Coolify, the open-source self-hostable server/application/database management PaaS, allows an authenticated user with permission to edit application settings (versions prior to 4.0.0-beta.469) to run arbitrary commands on the managed host. The flaw lives in the executeInDocker() helper, which wraps user-controlled values in single quotes without escaping embedded quotes, letting an attacker break out of the quoted shell context during deployments and escape the intended Docker container confinement. No public exploit identified at time of analysis; this is not listed in CISA KEV.

Technical ContextAI

Coolify is a Laravel/PHP-based self-hosted deployment platform (an open-source alternative to Heroku/Netlify) that orchestrates Docker containers on managed servers. The vulnerable executeInDocker() helper constructs shell command strings by naively wrapping user-supplied fields - specifically docker_compose_custom_build_command and docker_compose_custom_start_command - in single quotes. Because embedded single quotes are not escaped or sanitized, this is a classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command) shell-metacharacter breakout: a payload containing a single quote terminates the intended quoted argument and appends attacker-controlled shell syntax. The injected command executes in the deployment context on the host operating system rather than inside the confined container.

RemediationAI

Vendor-released patch: upgrade Coolify to version 4.0.0-beta.469 or later, which fixes the improper quoting in executeInDocker(), as documented in advisory GHSA-j6j2-frv3-g6f7 (https://github.com/coollabsio/coolify/security/advisories/GHSA-j6j2-frv3-g6f7). If immediate upgrade is not possible, restrict who can edit application settings by tightening account provisioning and removing application-edit permissions from untrusted or non-administrative users, since exploitation requires that privilege (trade-off: limits legitimate self-service deployment configuration). As an additional compensating control, avoid granting Coolify management accounts to untrusted parties on shared/multi-tenant instances and audit the docker_compose_custom_build_command and docker_compose_custom_start_command fields for embedded single quotes or shell metacharacters (trade-off: manual review does not scale and can be bypassed by novel payloads). Isolating the Coolify host and monitoring deployment processes for unexpected child commands can help detect abuse until patched.