PT-2026-56126 · Coolify · Coolify

Published 2026-07-07 · Updated 2026-07-07 · CVE-2026-34034

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.466

Description An authenticated user with access to server Sentinel settings can execute commands on the host when Sentinel is restarted. This occurs because the sentinel token setting is used in shell commands without sufficient validation, allowing for the injection of shell syntax.

Recommendations Update to version 4.0.0-beta.466.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-34034

Affected Products

Coolify

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-34034 · Security Note
• https://github.com/coollabsio/coolify/security/advisories/GHSA-rpr8-p7jc-x844 · Note
• https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.466 · Note
• https://github.com/coollabsio/coolify/commit/096d4369e59b3db7ace2db3ca42588c41b9b6019 · Note
• https://twitter.com/CVEnew/status/2074365833422229794 · Twitter Post
• https://twitter.com/infoflowcloud/status/2074366976210706792 · Twitter Post