PT-2026-56008 · Coollabsio · Coolify

Themehackers · Published 2026-07-06 · Updated 2026-07-06 · CVE-2026-34038

NVD

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, an authenticated remote command injection vulnerability in application deployment handling allows users with application write permissions to achieve remote code execution and exfiltrate sensitive environment variables through deployment logs via fields such as dockerfile location and deployment commands. This issue is fixed in version 4.0.0-beta.469.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-34038

Affected Products

Coolify

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-34038 · Security Note
• https://github.com/coollabsio/coolify/security/advisories/GHSA-qqrq-r9h4-x6wp · Note
• https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.469 · Note
• https://github.com/coollabsio/coolify/commit/23f9156c7306b221101f1ebbe4d3c6b5e2522acd · Note
• https://github.com/coollabsio/coolify/pull/9007 · Note