Coolify CVE-2026-34168

Requires an authenticated Coolify account with the ability to create a LocalPersistentVolume / storage and set its name (PR:L), and the malicious name must contain shell metacharacters. The payload does not fire on creation - the concrete trigger is deletion of the resource associated with that volume, which invokes the vulnerable docker volume shell command. Limiting factors: exploitation only affects versions prior to 4.0.0-beta.471, needs a valid low-privilege account rather than anonymous access, and depends on the delete workflow being reached; the command executes in the context of the managed server(s) the instance controls.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) is internally consistent with the description: network-reachable web app, low complexity, and low-privilege authenticated access (any user who can define a storage volume). The high C/I/A reflects full command execution on managed servers. No EPSS score, SSVC decision, KEV entry, or POC was provided, so exploitation-probability signals are absent rather than low; this should be read as unknown, not safe. The main mitigating factor is the PR:L requirement plus a deletion trigger (the payload fires when the resource is deleted), so an attacker needs a valid account and must reach the delete workflow. Given Coolify instances are often multi-tenant or expose accounts to semi-trusted team members, PR:L is a realistic bar, making this a genuine priority for anyone running affected versions rather than a high-CVSS-but-low-real-risk finding.

A low-privileged but authenticated Coolify user creates a persistent storage volume whose name contains shell metacharacters (for example a name embedding a command substitution or command separator). When that resource is later deleted, Coolify builds a docker volume command with the unescaped name and executes it against a managed server, running the attacker's payload with the privileges of the Coolify agent on that host. No admin interaction is required beyond the deletion action, and network reachability plus a valid account are the only prerequisites; no public exploit is identified at time of analysis.