Coolify CVE-2026-34167

Exploitation requires a valid authenticated user account on the Coolify instance (PR:L per CVSS vector). The vulnerability is present in the default Coolify configuration whenever the ActivityMonitor Livewire component is accessible, which is standard for any Coolify deployment. No special permissions, admin role, or specific feature toggle is needed beyond basic login. Exploitation is limited to instances with multiple teams or users - a single-user deployment has no cross-team data to enumerate. The key limiting factor is that attackers must have a legitimate account on the target Coolify instance; anonymous or unauthenticated exploitation is not possible per the CVSS PR:L metric.

The NVD CVSS 3.1 score of 5.0 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N reflects a medium-severity rating, but the C:L assignment likely understates real-world impact: SSH process outputs intercepted via this flaw can contain private keys, plaintext passwords, API tokens, and server configuration secrets that enable full infrastructure compromise beyond Coolify itself. The S:C (scope changed) metric correctly captures that exploitation crosses team isolation boundaries - a fundamental multi-tenancy breach. PR:L confirms authentication is required, which limits the attack surface to registered users of the Coolify instance, not anonymous internet actors. No EPSS score was provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. However, the near-zero attack complexity (sequential integer guessing requires no tooling) means any authenticated user can exploit this immediately. Real-world priority is HIGH for multi-tenant Coolify instances and LOW for single-user or single-team deployments where cross-team enumeration yields no additional access.

An authenticated low-privilege user on a shared Coolify instance navigates to the ActivityMonitor component and intercepts the Livewire network request. They replace the activityId value with sequential integers - 1, 2, 3, and so on - in their browser's developer tools or a proxy, iterating through all activities recorded on the system. Within minutes they retrieve SSH deployment logs from other teams containing environment variables, database passwords, and private key material used in automated provisioning workflows.