CVE-2026-34167: Coolify ActivityMonitor Authorization Bypass—Activity Log Enumeration

Technical summary

The ActivityMonitor Livewire component in Coolify exposes a public $activityId property without the #[Locked] attribute, allowing client-side manipulation. The component retrieves activities via Activity::find($this->activityId) without authorization checks or team-based access control. Since activity IDs are auto-incrementing integers, an authenticated attacker can enumerate the activity table by iterating through sequential IDs and retrieve full command output from remote SSH process logs. The vulnerability stems from missing authorization logic (CWE-639: Authorization through User-Controlled Key) rather than authentication bypass—an attacker must have valid Coolify credentials to exploit it.

Business impact

Organizations self-hosting Coolify may expose operational secrets to internal users or compromised accounts. If SSH command output is logged verbatim, attackers can harvest database credentials, API keys, private SSH keys, and infrastructure topology details that would typically be restricted to team members. This escalates the impact of account compromise and increases lateral movement risk. The exposure is particularly acute in multi-tenant or multi-team deployments where logical isolation is expected.

Affected systems

Coolify versions prior to 4.0.0-beta.471 are affected. The open-source project has no separate enterprise editions or vendor-specific variants. Self-hosted instances are vulnerable regardless of deployment topology (single-server, Kubernetes, etc.). The fix is available immediately in version 4.0.0-beta.471 and later.

Exploitability

Exploitation requires valid Coolify authentication, keeping the attack surface to authorized users or those with compromised credentials. No complex exploitation steps are needed—an attacker simply changes the activityId parameter in requests to enumerate and access logs from other teams. The attack is trivial once credentials are obtained, and activity IDs are predictable. Overall CVSS score of 5 (Medium) reflects the need for prior authentication and limited confidentiality impact, though the ease of exploitation within that constraint is high.

Remediation

Upgrade Coolify to version 4.0.0-beta.471 or later. The fix implements proper authorization checks so that users can only view activities belonging to their own team, and adds Livewire's #[Locked] attribute to prevent client-side property manipulation. For organizations unable to upgrade immediately, restrict Coolify access to trusted internal networks and monitor activity logs for suspicious enumeration patterns (sequential or bulk activityId requests).

Patch guidance

Apply the official Coolify update to 4.0.0-beta.471 or later through your standard deployment method (Docker, git pull, package manager, etc.). Verify the update by checking the version in the Coolify UI or logs. No data migration or configuration changes are required. If you are running a stable release branch (not beta), check the official Coolify repository for the corresponding stable patch version that includes this fix.

Detection guidance

Monitor HTTP logs or Livewire traffic for repeated requests to the ActivityMonitor component with varying activityId parameters, especially sequential or high-volume ID enumeration. Check Coolify's internal logs for activity retrievals outside the user's own team scope if such logging is available. Review SSH command output logs for exfiltration of credentials or sensitive data that should not have been visible to specific users. If you have multi-team deployments, audit which activities each user has accessed.

Why prioritize this

Although CVSS 5 appears moderate, this vulnerability presents elevated risk in multi-team or multi-user environments where logical isolation is a security assumption. Secrets and infrastructure details in SSH logs are high-value targets. Prioritization should account for your deployment model: single-team instances face lower risk, while multi-team instances should patch urgently. The low exploitation barrier (once authenticated) and lack of KEV/ransomware signals suggest standard patching priority rather than emergency response.

Risk score, explained

CVSS 5 (Medium) reflects: Network-accessible attack vector, low complexity, and requirement for low privilege (authenticated user). The scope is changed because the attacker can access data outside their assigned team, violating the original security boundary. Confidentiality impact is low in the CVSS model because activity logs are not universally sensitive, but real-world impact depends on what SSH commands and outputs your deployments log. The absence of integrity or availability impact (no modification or denial of service) keeps the score moderate despite the practical severity of data exposure.

Frequently asked questions