CVE-2026-34152: Coolify Command Injection via SSH Heredoc Escape Bypass

Technical summary

Coolify's pre-deployment and post-deployment command handling uses single-quote escaping, which nominally prevents shell interpretation. However, these escaped commands are then transmitted through SSH heredoc syntax (a here-document mechanism), which preserves literal newlines in its payload. This allows an authenticated attacker to inject shell metacharacters and additional statements after the newline, bypassing the single-quote escaping layer. The injected commands execute on the remote server with the security context of the SSH session. This is fundamentally a command injection vulnerability (CWE-78) arising from insufficient input sanitization when transitioning between escaping contexts.

Business impact

Successful exploitation enables lateral movement and privilege escalation within deployed infrastructure. An attacker with Coolify credentials—such as a developer with deployment permissions or a compromised user account—gains code execution on managed servers. This could lead to data exfiltration from databases, modification or deletion of deployed applications, installation of backdoors, or lateral movement to other systems in the infrastructure. For organizations using Coolify in production, this directly threatens the confidentiality, integrity, and availability of managed workloads. The impact escalates if the affected Coolify instance manages critical or customer-facing applications.

Affected systems

Coolify versions prior to 4.0.0-beta.471 are vulnerable. The vulnerability requires authentication, so it affects deployments where user accounts exist and have deployment privileges. Any organization self-hosting Coolify for infrastructure management, application deployment, or database management should assess whether they are running an affected version and whether any user accounts have been compromised or misused.

Exploitability

Exploitation requires valid Coolify credentials (authentication factor), but no user interaction or special configuration is needed beyond that. The attack is straightforward once authenticated: an attacker simply includes a newline and additional shell syntax in a pre-deployment or post-deployment command field, and the injected code executes on the target server during the next deployment. The network accessibility is normal—SSH is the standard transport—and the barrier to exploitation is solely the requirement for an authenticated account. This makes the vulnerability practical to exploit in insider threat scenarios or when accounts are compromised.

Remediation

Update Coolify to version 4.0.0-beta.471 or later, which fixes the heredoc injection flaw by properly sanitizing command input before SSH transmission. Verify the update is applied to your deployment. Additionally, implement principle-of-least-privilege access controls: audit which users have deployment permissions in Coolify and restrict them to only those who require them. Monitor deployment logs and SSH audit trails for suspicious command injection patterns during deployments. Consider network segmentation to limit the blast radius if a compromise occurs.

Patch guidance

Consult the official Coolify repository and release notes to verify the exact version and deployment method for your installation. Update to 4.0.0-beta.471 or any released stable version that includes the fix (post-beta releases are expected to incorporate this patch). For self-hosted instances, follow Coolify's documented upgrade process, which typically involves pulling the latest container image or updating from source. Validate the update by checking the running version and re-testing pre- and post-deployment commands in a non-production environment to ensure backward compatibility with your deployment scripts.

Detection guidance

Monitor Coolify deployment logs for unusual pre- or post-deployment command executions, particularly commands that contain shell metacharacters (pipes, semicolons, newlines represented as escape sequences) or unexpected statements unrelated to the declared deployment logic. Audit SSH server logs on managed remote servers for commands executed during deployments that deviate from expected patterns. Search for signs of command injection such as multiple sequential commands or attempts to read/modify sensitive files during deployment windows. Implement alerts on Coolify audit trails when deployment commands are modified or when deployments fail unexpectedly, as these may indicate injection attempts or compromised accounts.

Why prioritize this

This vulnerability merits immediate priority due to its HIGH CVSS score (8.8) and direct path to code execution on managed infrastructure. While authentication is required, the ease of exploitation once authenticated, combined with the potential for complete server compromise and lateral movement, makes this a critical risk for organizations relying on Coolify for production deployments. The fact that it is not yet in the KEV (Known Exploited Vulnerabilities) catalog does not diminish the urgency—exploitation requires only credential access, and the impact is severe. Organizations should patch within their standard emergency update window.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects the vulnerability's capacity to provide high impact across confidentiality, integrity, and availability (C:H, I:H, A:H) with low attack complexity (AC:L) and network-based access (AV:N). The primary limiting factor is the requirement for prior authentication (PR:L), which prevents unauthenticated attacks. The score appropriately captures a scenario where a legitimate but compromised or malicious user can fully compromise a managed server. For organizations running Coolify in critical infrastructure, the business risk may warrant treating this as CRITICAL internally.

Frequently asked questions