What is the CVSS score of CVE-2026-34599?

CVE-2026-34599 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.4%.

Which versions of Coolify are affected by CVE-2026-34599?

Coolify self-hosted PaaS deployments are vulnerable to unauthorized infrastructure compromise, where any team member with basic access can take full control of all connected servers, creating an…. A patch is available.

How to fix or mitigate CVE-2026-34599?

24 hours: Audit all team members with access to Coolify and restrict to essential personnel only; document current server inventory. 7 days: Implement network segmentation between Coolify and managed servers; deploy WAF/firewall rules to restrict control protocol access. 30 days: Upgrade to Coolify 4.0.0-beta.471 or later when released; evaluate alternative PaaS solutions if upgrade timeline conflicts with risk tolerance.

Coolify CVE-2026-34599

EUVD-2026-41957 HIGH

OS Command Injection (CWE-78)

2026-07-06 GitHub_M

Docker Command Injection Coolify Coollabsio

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable Livewire endpoint (AV:N), trivial injection (AC:L), requires lowest team member role (PR:L), no interaction; root command execution yields full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 06, 2026 - 23:01 EUVD

Analysis Generated

Jul 06, 2026 - 22:32 vuln.today

CVE Published

Jul 06, 2026 - 21:20 cve.org

HIGH 8.8

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, there is an authenticated command injection vulnerability in the GetLogs Livewire component which allows users with team membership (lowest privilege member role) to execute arbitrary commands as root on managed servers. The $container Livewire public property is interpolated directly into shell commands (docker logs, docker service logs) without sanitization, and can be modified by any client via the Livewire wire protocol because it lacks the #[Locked] attribute. This issue is fixed in version 4.0.0-beta.471.

Articles & Coverage 1

News 5 New Docker Vulnerabilities - 1 Critical, 4 High, 1 With POC Jul 07, 2026

AnalysisAI

Privilege escalation to root command execution in Coolify (self-hosted PaaS) prior to 4.0.0-beta.471 lets any authenticated user holding the lowest-privilege team 'member' role run arbitrary OS commands as root on every server Coolify manages. The flaw lives in the GetLogs Livewire component, whose $container public property is unsanitized and lacks the #[Locked] attribute, so any team member can tamper with it over the Livewire wire protocol. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the low authentication barrier and full CIA impact make it high priority for any multi-tenant Coolify deployment.

Technical ContextAI

Coolify is an open-source, self-hostable Heroku/Netlify-style platform (CPE cpe:2.3:a:coollabsio:coolify) built on the Laravel + Livewire stack. Livewire exposes server-side component properties to the browser and re-hydrates them from client requests; developers must mark trusted properties with #[Locked] to prevent client-side tampering. Here the GetLogs component interpolates its $container property directly into shell strings ('docker logs', 'docker service logs') that Coolify executes on managed nodes as root. Because $container is a public, unlocked property, the CWE-78 (OS Command Injection) root cause is reachable purely by editing the value the client sends - classic shell metacharacter injection via an unvalidated, attacker-controllable Livewire binding.

RemediationAI

Upgrade to the vendor-released patch: Coolify 4.0.0-beta.471, which adds the #[Locked] attribute and input sanitization for the GetLogs $container property (fix delivered via PR https://github.com/coollabsio/coolify/pull/9229 and commit f267a28cb2badc7e712c4592af4d79d090fe5063; advisory GHSA-q9j6-xcvx-px63). If you cannot upgrade immediately, reduce exposure by tightly restricting team membership - remove untrusted or unnecessary 'member' accounts and audit who can reach the log-viewing UI, since exploitation requires an authenticated team member; also place the Coolify dashboard behind a VPN/allowlist so the Livewire endpoint is not broadly reachable. These controls limit who can send the malicious wire request but do not remove the code path, so patching remains the only complete fix.