CVE-2026-34599: Coolify Authenticated Command Injection Leading to Root Code Execution

Technical summary

CVE-2026-34599 is an authenticated command injection vulnerability in Coolify's GetLogs Livewire component (versions before 4.0.0-beta.471). The $container property, exposed as a public Livewire property without the #[Locked] attribute, is interpolated directly into docker logs and docker service logs shell commands without input validation. The Livewire wire protocol permits any authenticated client to modify this property, enabling OS command injection. An attacker with team membership (the lowest privilege role) can inject shell metacharacters to execute arbitrary commands in the context of the root user on managed infrastructure.

Business impact

Organizations running Coolify for infrastructure management face a critical insider threat: any team member, contractor, or account with minimal privileges can compromise all connected servers and databases. This undermines the principle of least privilege and creates a pathway to lateral movement, data exfiltration, ransomware deployment, or destructive actions. Self-hosted deployments are particularly vulnerable because Coolify typically manages production infrastructure directly.

Affected systems

Coolify versions prior to 4.0.0-beta.471 are affected. The vulnerability requires authentication (team membership), so only instances accessible to authenticated users are at immediate risk. Open-source deployments and commercial self-hosted installations of Coolify are in scope.

Exploitability

Exploitability is straightforward for anyone with valid team credentials. No user interaction is required beyond authentication, and the attack surface is direct: the GetLogs Livewire component is a normal application feature. The low privilege requirement (team membership) means this is not restricted to administrators. Proof-of-concept development would be trivial for a competent attacker with access to the application.

Remediation

Upgrade Coolify to version 4.0.0-beta.471 or later immediately. The fix involves adding the #[Locked] attribute to the $container property to prevent client-side modification, and sanitizing or properly escaping any user-influenced input before interpolation into shell commands. Organizations should audit team membership and review logs for suspicious command activity following the upgrade.

Patch guidance

Update to Coolify 4.0.0-beta.471 or the next stable release (verify against vendor advisory for the stable channel release date and version number). Apply this patch to all Coolify instances, particularly those managing production infrastructure. Test the patch in a non-production environment first to ensure compatibility with your server and application configurations.

Detection guidance

Monitor Coolify application logs and managed server logs for anomalous docker log or docker service logs command invocations. Look for shell metacharacters (backticks, $(…), |, &, ;, etc.) in container names within Livewire logs or HTTP request bodies. Check the Coolify database for suspicious modifications to container identifiers or unexpected command execution timestamps that correlate with low-privilege user activity. Review authentication logs for team member activity during off-hours or from unusual locations.

Why prioritize this

This vulnerability should receive immediate attention due to the combination of high CVSS (8.8), low privilege requirement for exploitation, and direct impact to infrastructure integrity. Unlike many command injection flaws that require administrator access, this one is accessible to any team member, making it a critical insider threat vector. Organizations with Coolify managing production systems should treat this as urgent.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a network-accessible, low-complexity authenticated attack that achieves high impact across confidentiality, integrity, and availability. The primary mitigating factor is the authentication requirement; however, the low privilege threshold (team membership) and direct root code execution severely limit the practical impact of that control. The score appropriately reflects the severity in real-world deployments.

Frequently asked questions