What’s Vulnerable › Vulnerabilities

CVE-2026-34594: Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-29 · updated 2026-10-25
• Weakness: CWE-78

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, an authenticated command injection vulnerability in the Destination Network Management functionality allows users with destination management permissions to execute arbitrary commands as root on managed servers. The "network" parameter is passed directly to shell commands without proper sanitization, enabling full remote code execution on the host system. This vulnerability is fixed in 4.0.0-beta.471.

Affected products

• coollabsio coolify: before 4.0.0-beta.471

References

• https://github.com/coollabsio/coolify/security/advisories/GHSA-mf8p-rj62-9f9m
• https://github.com/coollabsio/coolify/security/advisories/GHSA-mf8p-rj62-9f9m

Get alerted when CVE-2026-34594 or the next vulnerability affects your stack