CVE-2026-34035: Coolify Log Drain Command Injection (CVSS 8.8)

Technical summary

CVE-2026-34035 is a command injection vulnerability (CWE-78) in Coolify's log drain functionality. The vulnerability stems from insufficient encoding of log drain secrets and environment values before interpolation into shell commands. An authenticated attacker can craft malicious input containing shell metacharacters or command sequences that are executed with the privileges of the Coolify process on the host system. The CVSS 3.1 score of 8.8 reflects network accessibility, low complexity, required authentication, and high impact across confidentiality, integrity, and availability.

Business impact

A compromised Coolify instance enables attackers to gain shell access to hosting infrastructure. This permits data exfiltration, application tampering, lateral movement to other systems on the network, and potential destruction or encryption of hosted databases and applications. For organizations relying on Coolify for multi-tenant or multi-application management, a single compromised credential can cascade into infrastructure-wide compromise.

Affected systems

Coolify versions prior to 4.0.0-beta.466 are vulnerable. The open-source nature means exposure extends across any organization self-hosting Coolify, including enterprises managing private infrastructure, managed service providers, and development teams using Coolify for application deployment.

Exploitability

Exploitation requires valid Coolify credentials, limiting the attack surface to authenticated users or attackers who have compromised legitimate accounts. However, the simplicity of command injection via log drain configuration—likely accessible through the Coolify web interface—makes exploitation straightforward once authentication is achieved. No special tools or interactions are required beyond normal application functionality.

Remediation

Upgrade Coolify to version 4.0.0-beta.466 or later. Organizations should prioritize this patching, particularly for instances exposed to the network or shared among multiple users. Credential management should be reviewed to ensure no unauthorized access occurred during the vulnerability window.

Patch guidance

Update to Coolify 4.0.0-beta.466 or any subsequent stable release. This patch includes proper encoding of log drain secrets and environment variables before shell command execution. Verify the patch through the official Coolify repository and release notes. Organizations should test the update in a non-production environment first, as beta versions may require validation.

Detection guidance

Monitor Coolify logs for suspicious log drain configuration changes, particularly entries showing unusual characters, command operators (pipes, semicolons, backticks), or environment variable references in log drain settings. Search for shell commands executed by the Coolify process that differ from normal application behavior. Host system auditing (auditd on Linux) can capture unexpected process execution tied to Coolify's runtime user.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score, the severity of command injection impacts (full host compromise), and the authenticated-but-straightforward exploitation path. While KEV listing has not occurred, organizations managing production infrastructure through Coolify should treat this as a priority patch to prevent credential-based lateral movement.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: network accessibility enabling remote exploitation, low attack complexity requiring only standard Coolify functionality, low privileges requiring valid authentication, and severe impact allowing complete control over host systems, databases, and applications managed by Coolify. The vulnerability does not require user interaction and affects system confidentiality, integrity, and availability equally.

Frequently asked questions