CVE-2026-34058: Coolify Command Injection in Server Resources (8.8 HIGH)

Technical summary

The vulnerability stems from improper input handling in Livewire-based PHP methods (startUnmanaged, stopUnmanaged, restartUnmanaged) within the Server\Resources component. These methods accept a container ID parameter from browser requests and interpolate it directly into shell commands executed via SSH without sanitization or escaping. This classic OS command injection pattern (CWE-78) allows an authenticated attacker to inject shell metacharacters and execute arbitrary commands in the context of the remote server's SSH session. The lack of parameterization or shell escaping mechanisms (e.g., escapeshellarg) makes exploitation trivial once authentication is bypassed or an insider threat exists.

Business impact

Organizations using Coolify to manage production infrastructure face significant operational and security risk. A compromised or malicious team member can laterally move to managed servers, exfiltrate data, deploy malware, modify configurations, or disrupt services. For multi-tenant deployments, a single authenticated user could potentially compromise multiple server environments. The impact is amplified if Coolify manages critical databases or application servers, as attackers could gain persistent access, tamper with data integrity, or trigger compliance violations. Incident response and forensics become complex when SSH sessions are hijacked programmatically.

Affected systems

All versions of Coolify prior to 4.0.0-beta.471 are affected. The vulnerability is present in the open-source codebase and any deployment built from affected commits. Self-hosted Coolify instances running earlier versions are at risk. The attack surface is limited to authenticated users with team access to the Coolify interface, making insider threats and compromised accounts the primary attack vectors.

Exploitability

Exploitation requires valid authentication to the Coolify web interface, which limits opportunistic attacks from the public internet. However, the barrier to weaponization is extremely low—once authenticated, an attacker needs only to craft a malicious container ID (e.g., 'container123; rm -rf /', or using command substitution) and trigger one of the vulnerable methods through the browser. No special tools, reverse engineering, or timing attacks are required. The vulnerability is not currently tracked in the CISA KEV catalog, indicating no evidence of active exploitation in the wild as of the publication date, but this should not diminish its severity given the ease of exploitation.

Remediation

Upgrade Coolify to version 4.0.0-beta.471 or later, which implements proper input validation and command escaping. If immediate patching is not feasible, restrict team member access to the Coolify interface to only trusted, vetted personnel and monitor SSH access logs for anomalous activity on managed servers. Consider deploying Coolify in an isolated network segment and use SSH key-based authentication with audit logging enabled. Disable the startUnmanaged, stopUnmanaged, and restartUnmanaged methods if they are not actively used.

Patch guidance

Update Coolify from your current version to 4.0.0-beta.471 or any stable release that includes the fix. Review the official Coolify GitHub repository for release notes and verify the specific commit that addressed CWE-78 input validation. Test patches in a staging environment to ensure backward compatibility with your server configurations and container orchestration setup. After patching, restart the Coolify service and verify that container management operations function as expected before re-enabling production workloads.

Detection guidance

Monitor SSH logs on managed servers for unexpected command executions originating from Coolify service accounts, particularly commands containing shell metacharacters (|, &, ;, $(), backticks) or suspicious patterns (rm, dd, nc, bash -i). Enable Coolify's request logging if available and audit browser-to-SSH method calls for container IDs that contain non-alphanumeric characters. Implement Web Application Firewall (WAF) rules to block requests to the affected Livewire component methods that contain shell metacharacters. Review Coolify's internal audit logs for unusual usage of startUnmanaged, stopUnmanaged, and restartUnmanaged methods by team members.

Why prioritize this

Despite not being in the KEV catalog, this vulnerability merits immediate patching due to its HIGH CVSS score (8.8), low complexity of exploitation, and potential for complete server compromise. The attack requires only authentication (not network access to the server itself), making it attractive to insider threats or attackers who have obtained valid credentials through phishing or credential stuffing. The direct impact on confidentiality, integrity, and availability of managed infrastructure elevates risk for any organization relying on Coolify for critical operations.

Risk score, explained

The CVSS v3.1 score of 8.8 reflects high impact across all three security dimensions (C:H, I:H, A:H). Network accessibility (AV:N) and low attack complexity (AC:L) are partially mitigated by the requirement for prior authentication (PR:L), which prevents unauthenticated exploitation. The lack of user interaction (UI:N) means an attacker can exploit this programmatically. The unscoped nature (S:U) indicates no privilege escalation is required—the attacker gains command execution at the Coolify service level, which often runs with elevated privileges to manage containers and SSH connections.

Frequently asked questions