What’s Vulnerable › Vulnerabilities

CVE-2026-34035: Coolify: Host RCE via Log Drain secret/env command injection

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-07 · updated 2026-10-25
• Weakness: CWE-78

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, log drain secret and environment values were interpolated into shell commands without sufficient encoding, allowing an authenticated user to inject commands executed on the host. This issue is fixed in version 4.0.0-beta.466.

Affected products

• coollabsio coolify: before 4.0.0-beta.466

References

• https://github.com/coollabsio/coolify/commit/fcd574e1eb1c2f504c48e5be4a5cb6d69f8f1f55
• https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.466
• https://github.com/coollabsio/coolify/security/advisories/GHSA-3xm2-hqg8-4m2p
• https://github.com/coollabsio/coolify/security/advisories/GHSA-3xm2-hqg8-4m2p

Get alerted when CVE-2026-34035 or the next vulnerability affects your stack